US20140282872A1 - Stateless web content anti-automation - Google Patents
Stateless web content anti-automation Download PDFInfo
- Publication number
- US20140282872A1 US20140282872A1 US14/055,714 US201314055714A US2014282872A1 US 20140282872 A1 US20140282872 A1 US 20140282872A1 US 201314055714 A US201314055714 A US 201314055714A US 2014282872 A1 US2014282872 A1 US 2014282872A1
- Authority
- US
- United States
- Prior art keywords
- code
- computer
- web server
- security
- web
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
- 238000000034 method Methods 0.000 claims abstract description 85
- 230000009466 transformation Effects 0.000 claims abstract description 55
- 230000004048 modification Effects 0.000 claims abstract description 50
- 238000012986 modification Methods 0.000 claims abstract description 50
- 230000002441 reversible effect Effects 0.000 claims abstract description 50
- 230000004044 response Effects 0.000 claims abstract description 22
- 230000008569 process Effects 0.000 claims description 27
- 230000006870 function Effects 0.000 claims description 26
- 238000012545 processing Methods 0.000 claims description 13
- 239000013598 vector Substances 0.000 claims description 6
- 206010000117 Abnormal behaviour Diseases 0.000 claims description 5
- 230000000977 initiatory effect Effects 0.000 claims 1
- 230000001502 supplementing effect Effects 0.000 claims 1
- 230000000694 effects Effects 0.000 description 53
- 230000009471 action Effects 0.000 description 21
- 235000014510 cooky Nutrition 0.000 description 20
- 238000004891 communication Methods 0.000 description 18
- 238000004458 analytical method Methods 0.000 description 16
- 230000002159 abnormal effect Effects 0.000 description 13
- 230000003993 interaction Effects 0.000 description 12
- 230000015654 memory Effects 0.000 description 12
- 238000012546 transfer Methods 0.000 description 12
- 230000008859 change Effects 0.000 description 11
- 238000001514 detection method Methods 0.000 description 9
- 238000004590 computer program Methods 0.000 description 8
- 238000010586 diagram Methods 0.000 description 8
- 230000002547 anomalous effect Effects 0.000 description 7
- 238000013459 approach Methods 0.000 description 6
- 230000001010 compromised effect Effects 0.000 description 6
- 230000008901 benefit Effects 0.000 description 5
- 230000005540 biological transmission Effects 0.000 description 5
- 238000007726 management method Methods 0.000 description 5
- 238000012544 monitoring process Methods 0.000 description 4
- 230000008520 organization Effects 0.000 description 4
- 238000013515 script Methods 0.000 description 4
- 238000013519 translation Methods 0.000 description 4
- 230000014616 translation Effects 0.000 description 4
- 230000006399 behavior Effects 0.000 description 3
- 230000002829 reductive effect Effects 0.000 description 3
- 238000012552 review Methods 0.000 description 3
- 230000003068 static effect Effects 0.000 description 3
- 238000000844 transformation Methods 0.000 description 3
- 230000001131 transforming effect Effects 0.000 description 3
- 238000012384 transportation and delivery Methods 0.000 description 3
- 230000003287 optical effect Effects 0.000 description 2
- 238000009877 rendering Methods 0.000 description 2
- 238000000926 separation method Methods 0.000 description 2
- 239000013589 supplement Substances 0.000 description 2
- 238000012360 testing method Methods 0.000 description 2
- 241000283086 Equidae Species 0.000 description 1
- 241001331845 Equus asinus x caballus Species 0.000 description 1
- 238000006424 Flood reaction Methods 0.000 description 1
- 241000700605 Viruses Species 0.000 description 1
- 230000004075 alteration Effects 0.000 description 1
- 238000013475 authorization Methods 0.000 description 1
- 238000004422 calculation algorithm Methods 0.000 description 1
- 230000001413 cellular effect Effects 0.000 description 1
- 239000003795 chemical substances by application Substances 0.000 description 1
- 238000007405 data analysis Methods 0.000 description 1
- 238000013523 data management Methods 0.000 description 1
- 238000013500 data storage Methods 0.000 description 1
- 230000003292 diminished effect Effects 0.000 description 1
- 239000000835 fiber Substances 0.000 description 1
- ZXQYGBMAQZUVMI-GCMPRSNUSA-N gamma-cyhalothrin Chemical compound CC1(C)[C@@H](\C=C(/Cl)C(F)(F)F)[C@H]1C(=O)O[C@H](C#N)C1=CC=CC(OC=2C=CC=CC=2)=C1 ZXQYGBMAQZUVMI-GCMPRSNUSA-N 0.000 description 1
- 230000036541 health Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000009434 installation Methods 0.000 description 1
- 230000002452 interceptive effect Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 238000010801 machine learning Methods 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000006855 networking Effects 0.000 description 1
- 238000004806 packaging method and process Methods 0.000 description 1
- 239000000047 product Substances 0.000 description 1
- 238000007790 scraping Methods 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 230000035945 sensitivity Effects 0.000 description 1
- 238000007619 statistical method Methods 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001960 triggered effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
- G06F21/128—Restricting unauthorised execution of programs involving web programs, i.e. using technology especially used in internet, generally interacting with a web browser, e.g. hypertext markup language [HTML], applets, java
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/90—Details of database functions independent of the retrieved data types
- G06F16/95—Retrieval from the web
- G06F16/958—Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/10—Protecting distributed programs or content, e.g. vending or licensing of copyrighted material ; Digital rights management [DRM]
- G06F21/12—Protecting executable software
- G06F21/121—Restricting unauthorised execution of programs
- G06F21/125—Restricting unauthorised execution of programs by manipulating the program code, e.g. source code, compiled code, interpreted code, machine code
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
- H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
- H04L63/0471—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
- H04L63/102—Entity profiles
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/12—Applying verification of the received information
- H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/145—Countermeasures against malicious traffic the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1483—Countermeasures against malicious traffic service impersonation, e.g. phishing, pharming or web spoofing
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/16—Implementing security features at a particular protocol layer
- H04L63/168—Implementing security features at a particular protocol layer above the transport layer
Definitions
- This document generally relates to computer security, and more specifically to efforts to prevent malware from automatically attacking web and other content.
- Computer fraud is big business both for the fraudsters and the people who try to stop them.
- One common area of computer fraud involves attempts by organizations to infiltrate computers of ordinary people, and by that action to trick those people into giving up confidential information, such as credit card information and access codes.
- a user's computer can be provided with code that intercepts legitimate communications by the user, such as with the user's bank, and does so after the communications have been decrypted, e.g., by a web browser on the computer.
- Such code may alter the interface that the user sees, such as by generating an interface that looks to the user like their bank is requesting particular information (e.g., a PIN number) when in fact the bank would never request such information via a web page.
- the code may generate an interface that indicates to a user that a banking or shopping transaction was executed as the user requested, when in fact, the illegal organization altered the transaction so as to send the user's money to an entity associated with the organization.
- This document describes systems and techniques by which web code (e.g., HTML, CSS, and JavaScript) is modified before it is served over the internet by a server system so as to make more difficult the exploitation of the server system by clients that receive the code (including clients that are infected without their users' knowledge).
- the modifications may differ for different times that a web page and related content are served, whether to the same client computer or to different client computers.
- two different users or a single user in two different web browsing sessions
- the names that are served to a client device for various software objects may be changed in essentially random ways each time a page is served.
- a main purpose of such action is to create a moving target with the code, so that malicious code cannot use predictability of the code in order to interact with the content in a malicious way.
- changing the code served to client devices in an essentially random manner each time the code is served can deter malicious code executing on the client computers (e.g., Man in the Browser bot) from interacting with the served code in a predictable way so as to trick a user of the client computer into providing confidential financial information and the like.
- external programs generally cannot drive web application functionality directly, and so preventing predictable interaction with served code can be an effective means of preventing malicious computer activity.
- creating a moving, unpredictable target by modifying aspects of web code each time it is served can prevent or deter a wide variety of computer attacks.
- such techniques can be used to combat credential stuffing, in which malicious parties obtain leaked or cracked user credentials for a given web service and then use automated bots to perform credential testing at other websites or services based on the illicitly obtained credentials.
- bots that seek to either listen for user credentials or to perform automated credential testing may be thwarted by random changes in the web code that significantly complicate the bot's task of determining how to effectively interact with the web code.
- Some of these attacks include: (a) denial of service attacks, and particularly advanced application denial of service attacks, where a malicious party targets a particular functionality of a website (e.g., a widget or other web application) and floods the server with requests for that functionality until the server can no longer respond to requests from legitimate users; (b) rating manipulation schemes in which fraudulent parties use automated scripts to generate a large number of positive or negative reviews of some entity such as a marketed product or business in order to artificially skew the average rating for the entity up or down; (c) fake account creation in which malicious parties use automated scripts to establish and use fake accounts on one or more web services to engage in attacks ranging from content spam, e-mail spam, identity theft, phishing, ratings manipulation, fraudulent reviews, and countless others; (d) fraudulent reservation of rival goods, where a malicious party exploits flaws in a merchant's website to engage in a form of online scalping by
- the systems, methods, and techniques for web code modifications described in this paper can prevent or deter each of these types of attacks. For example, by randomizing the implicit references in web code that may be used for making requests to a web server or by randomly injecting distracter fields into the code that were not originally part of the code provided by the web server, the effectiveness of bots and other malicious automated scripts is substantially diminished.
- malware activity can be both deflected and detected in relatively sophisticated manners by changing the environment in which executable code on the client device, such as JavaScript, operates (in addition to changing corresponding references in the HTML code).
- Deflection occurs by the constant changing of code elements as they are served each time, such as changing the names of elements that will be called by malicious JavaScript, so that the malicious code can never catch up with the changes, and thus gives itself away when it tries to interoperate with code known by the system to be stale.
- Detection can occur by identifying certain JavaScript operations or calls that may be made on a page, and instrumenting code that is served with a web page so as to report to a security server system when such operations occur and/or such calls are made (along with information that describes the actions).
- malicious code may try to call an item that it believes to be part of a static page, where that item is not part of the dynamically altered code that was actually served, and such a false call can be detected and reported.
- a common method for making changes to a document object model (DOM) for a web page is the document.write method, and may be used by malicious code to surreptitiously change what the user of a computing device sees on a web page.
- a security system can (1) instrument served code corresponding to such a method so that the instrumentation code reports calls to the method, and additional includes data that characterizes such calls, so that the system can detect abnormal activity and perhaps use the additional data to determine whether the abnormal activity is malicious or benign; and (2) change the function name to “document.#3@1*87%5.write,” “1@2234$56%.4$4$345%4.@12111@”, or some other legal name that includes random text that can be changed automatically each time the code is served.
- Such constant changing creates a real challenge for a malicious party seeking to write code that can keep up with the changes, and also flags the presence of the malicious code when it attempts to interact with an outdated method name, and is reported by the instrumentation code.
- Other examples of JavaScript actions that can be instrumeand continually changed include “getElementById,” “getElementByName,” XPath commands, and setting of HTML elements in the DOM to particular values.
- the modification of code may be carried out by a security system that may supplement a web server system, and may intercept requests from client computers to the web server system and intercept responses from web servers of the system when they serve content back to the client computers (including where pieces of the content are served by different server systems).
- the modification may be of static code (e.g., HTML) and of related executable code (e.g., JavaScript) in combination.
- HTML static code
- JavaScript related executable code
- the names of certain elements on a web page defined via HTML may be changed, as may references to items external to the HTML (e.g., CSS and JavaScript code).
- the name of a label may be changed from a name provided by a programmer to an essentially random name like $4@376&8*.
- Such renaming may occur by first identifying programmatically related elements across the different types of code that are to be served to the client computer (e.g., HTML, CSS, and JavaScript) and grouping such occurrences of elements for further processing (e.g., by generating flags that point to each such element or copying a portion of each such element). Such processing may occur by modifying each element throughout the different formats of code, such as changing a name in the manner above each time that name occurs in a parameter, method call, DOM operation, or elsewhere. The modified elements may then be placed into the code to be delivered to the client computer, by recoding the code that was sent from the web server system, and serving the recoded code. Such a process may be repeated each time a client computer requests code, and the modifications may be different for each serving of the same code.
- Such modification of the served code can help to prevent bots or other malicious code operating on client computers from exploiting perceived weaknesses in the web server system.
- the names of functions or variables may be changed in various random manners each time a server system serves the code.
- such constantly changing modifications may interfere with the ability of malicious parties to identify how the server system operates and web pages are structured, so that the malicious party cannot generate code to automatically exploit that structure in dishonest manners.
- this document refers to changes between different sessions or page loads that prevent someone at an end terminal or controlling an end terminal to identify a pattern in the server-generated activity.
- a reversible function may change the names when serving the code, and may interpret any HTTP requests received back from a client by changing the names in an opposite direction (so that the responses can be interpreted properly by the web servers even though the responses are submitted by the clients with labels that are different than those that the web servers originally used in the code).
- Such techniques may create a moving target that can prevent malicious organizations from reverse-engineering the operation of a web site so as to build automated bots that can interact with the web site, and potentially carry out Man-in-the-Browser and other Man-in-the-Middle operations and attacks.
- the ability to modify code that is served and to, in effect, reverse modify requests that are received back from a client device can be made easier and more flexible by implementing the security server system as a stateless system, i.e., one that does not have to keep track of sessions with various client device in between communications with those devices.
- One such way to implement a statement system is to have the client device keep track of state-related information during such interstitial periods.
- an initialization vector and cipertext that represents a code used to transform the outgoing content may be provided as a session cookie to the client device when the content is provided. The client device may then submit that cookie information when it makes a subsequent request.
- That request may include transformed information that the web server system would not understand, so the security system needs to perform a reverse transformation on it.
- the system may thus use the vector and ciphertext (along with its own private key) without having to store and keep track of it in order to perform the reverse transformation before giving the request to the web server system.
- the code that is served to requesting clients may be supplemented with instrumentation code that is programmed to identify alien content in the rendered web page on the client.
- That instrumentation code that runs on the client may, for example, be programmed to identify a function call for a function name that does not match function calls that are permissible for a particular served web page (e.g., where the alien call may be one that matches a name from the page originally provided by a web server but does not match the revised name generated by the code alteration techniques discussed in the prior paragraph).
- alien content may simply be an indication that the user has installed a legitimate plug-in to his or her browser, or it may also be an indication that the user's computer has become infected with malicious code (e.g., JavaScript code). Additional techniques may be used once alien content is identified so as to determine whether the content is malicious or benign.
- malicious code e.g., JavaScript code
- the techniques discussed here may be carried out by a server subsystem that acts as an adjunct to a web server system that is commonly employed by a provider of web content.
- a server subsystem that acts as an adjunct to a web server system that is commonly employed by a provider of web content.
- an internet retailer may have an existing system by which it presents a web storefront at a web site (e.g., www.examplestore.com), interacts with customers to show them information about items available for purchase through the storefront, and processes order and payment information through that same storefront.
- the techniques discussed here may be carried out by the retailer adding a separate server subsystem (either physical or virtualized) that stands between the prior system and the internet.
- the new subsystem may act to receive web code from the web servers (or from a traffic management system that receives the code from the web servers), may translate that code in random manners before serving it to clients, may receive responses from clients and translate them in the opposite direction, and then provide that information to the web servers using the original names and other data.
- a system may provide the retailer or a third party with whom the retailer contracts (e.g., a web security company that monitors data from many different clients and helps them identify suspect or malicious activity) with information that identifies suspicious transactions.
- the security subsystem may keep a log of abnormal interactions, may refer particular interactions to a human administrator for later analysis or for real-time intervention, may cause a financial system to act as if a transaction occurred (so as to fool code operating on a client computer) but to stop such a transaction, or any number of other techniques that may be used to deal with attempted fraudulent transactions.
- the operation of a stateless security server system may provide one or more advantages. For example, certain implementations may eliminate a need to store and manage initialization vectors and other information needed to reverse-transform requests, which may be particularly relevant where many sessions are occurring at one time, and many of them never have a return request, such that the credentials would need to be saved for a time and constantly cleaned up by a system if a stateless approach were not used. Also, a stateless approach like those discussed here may eliminate the need to selectively direct return traffic to a particular security server sub-system.
- the request can be handled by any system that is executing the same transformation function as the original sub-system (as long as they all have access to the private key where such is needed in a particular implementation).
- such an approach may permit for automatic correlation of state with externally linked CSS and JavaScript files.
- a computer-implemented method for coordinating content transformation.
- the method comprises receiving, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet; modifying the computer code to obscure operation of the web server system that could be determined from the computer code; generating transformation information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system; and serving to the computing client the modified code and the reverse transformation information.
- At least some of the reverse transformation information can be encrypted so that code on the client computer cannot access the reverse transformation information.
- the reverse transformation information can comprise a nonce and ciphertext.
- the method may also comprise receiving a subsequent request and the transformation information from the computing client, and using the transformation information to apply a reverse transformation to a portion of the request.
- the method can include applying a private key held by the computer server system to the transformation information.
- a computer system for coordinating content transformation can include a web server that is configured to provide a resource in the form of computer code to client computing devices in response to requests from the client computing devices; and a security intermediary that is configured to (i) receive the resource from the web server before the resource is provided to the first client computing device, (ii) process the received resource, and (iii) transmit the processed resource and reverse transformation information to the first client computing device, wherein the reverse transformation information comprises information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system.
- the system can include a computer interface configured to receive resources from a web server that has been served in the form of computer code to client computing devices in response to requests from the client computing devices.
- FIG. 1A depicts a schematic diagram of an example system for serving web code and monitoring actions of client computers.
- FIG. 1B depicts a system-flow diagram of the example system and example operations of the system for serving web code and monitoring actions of client computers.
- FIG. 2 is a schematic diagram of a system for performing deflection and detection of malicious activity with respect to a web server system.
- FIG. 3 is a flow chart of a process for managing a state indicator.
- FIG. 4 shows schematically an encryption process
- FIG. 5 is a schematic diagram of a computer system.
- FIG. 1A is a schematic diagram of a system 100 for serving web code and monitoring actions of client computers to identify abnormal behavior and potentially malicious activity.
- Web code may include, for example, HTML, CSS, JavaScript, and other program code associated with the content or transmission of web resources such as a web page that may be presented at a client computing device 114 .
- the system 100 can detect and obstruct attempts by fraudsters and computer hackers to learn the structure of a website and exploit security vulnerabilities in the client device 114 .
- malware 118 may infect a client device 114 and gather sensitive information about a user of the device, discreetly modify an online transaction, or deceive a user into engaging in compromising activity such as divulging confidential information.
- Man-in-the-middle exploits are performed by one type of malware 118 that is difficult to detect on a client device 114 , but can use security vulnerabilities at the client to engage in such malicious activity.
- the system 100 can serve modified and instrumented web code to the client device 114 to detect and obstruct malware 118 attempts to discern and exploit operations of a web server 104 .
- the modified web code 114 A is represented as a portion of a document on the client device 114
- the instrumentation code 1148 is represented as another portion of the client device 114 .
- Such simplified representation is provided for sake of explanation, though actual delivery and execution of the code may take a variety of forms, including by a web browser on the client device 114 rendering a page and potentially accessing additional code (e.g., JavaScript or code from other domains) based on code that is part of the web page, and the browser may build a document object model in a familiar manner by such rendering and execution of the provided code.
- the system 100 can include a security intermediary 102 that is logically located between the web server 104 and one or more client devices 114 .
- the security intermediary 102 can receive a portion or all of the traffic, including web code, transmitted between client devices 114 and the web server 104 (and vice-versa).
- the web server 104 can forward the response to the security intermediary 102 (perhaps through a load balancer or other data management devices or applications) so that the web code for the response can be modified and also supplemented with instrumentation code 114 B.
- Modification of the web code may be random in certain manners, and can differ each time a response is served to a client to prevent malware 118 from learning the structure or operation of the web server 104 , or from being developed by a malicious organization that learns the structure or operation. Additionally, the web code can be supplemented with instrumentation code that is executable on the client device 114 . The instrumentation code 114 B may detect when abnormal behavior occurs on the client device 114 , such as possible unauthorized activity by the malware 118 , and can report the occurrence of such activity to the security intermediary 102 .
- security intermediary 102 When security intermediary 102 receives requests (e.g., HTTP requests) from clients in response to modified web code being processed on those clients, it can apply reverse modifications to the requests before forwarding the requests to the web server 104 . Additionally, the security intermediary 102 can receive reports from the instrumentation code that indicate abnormal behavior on the client device 114 , and the intermediary can log these events, alert the web server 104 to possible malicious activity, and send reports about such events to a central security server (not shown). The central security server may, in some implementations, analyze reports in the aggregate from multiple security intermediaries 102 , and/or reports from multiple client devices 114 and multiple computing sessions and page loads.
- requests e.g., HTTP requests
- the central security server may, in some implementations, analyze reports in the aggregate from multiple security intermediaries 102 , and/or reports from multiple client devices 114 and multiple computing sessions and page loads.
- the security intermediary 102 can additionally create a code that defines the transformation that was performed on the web code. For example, a particular function may be applied to strings in the code to generate random text, and that function can be seeded with a code that affects the result of the function—e.g., where application of the same seed and the same text will always produce the same “random” output, but a different seed is used for each request or session so that the served text is seen as random.
- the served text may also be accompanied with information that may be stored as a cookie 115 on the client device 114 . When the client device makes subsequent requests to the web server 104 , code on the client device may cause the cookie information to be passed with the request. Such cookie information may include, for example, an initialization vector (as a large random number) for the transformation function and cipertext (e.g., in Base64). The cookie may be treated by the system 100 as a session cookie in this example.
- Ciphertext QmFzZTY0IGVuY29kaW5nIHNjaGVtZXMgYXJlIGNvbW1vbmx5IHVz ZWQgd2hlbiB0aGVy ZSBpcyBhIG5lZWQgdG8gZW5jb2RlIGJpbmFyeSBkYXRhIHRoYXQgbmVlZHMg YmUgc3RvcmVkIGFuZCB0cmFuc2ZlcnJlZCBvdmVyIG1lZGlhIHRoYXQgYXJlIG Rlc2lnbmVkIHRvIGRlYWwgd2l0aCB0ZXh0dWFsIGRhdGEuIFRoa
- FIG. 1B is a schematic diagram of the system 100 depicted in FIG. 1A , including a process for serving code and monitoring actions of client computers to identify anomalous and potentially malicious activity.
- the system 100 may include a web server 104 , security intermediary 102 , security server 108 , and one or more client devices 112 and 114 .
- Client device 114 has been infected with malware 118 that may attempt to exploit security vulnerabilities at the client device 114 and/or the web server 104 , while client device 112 is “clean” or uninfected in this example.
- the malware 118 may have been written by an organized crime syndicate to identify transactions with a particular bank whose web site structure the syndicate has studied, and may attempt to induce users to provide private information such as PIN codes by recognizing when the bank's web page is loaded by a browser, and interfering with the normal user interface of the bank's web page, such as by generating a pop-up seeking the user's PIN number, in a manner that it looks to the user like the bank generated the pop-up.
- the system 100 would communicate with thousands, tens of thousands, hundreds of thousands, or millions of client devices—some compromised and some clean—over a long time period, though the number here is reduced for the sake of simplification.
- the web server 104 may host electronic resources and provide services over one or more networks such as the internet 110 .
- the web server 104 may serve code for pages of one or more websites by storing resources for each website such as HTML pages, scripts, images, media, and user data at the server 104 , and providing the resources upon request.
- the web server 104 may receive an HTTP request from a client device 112 that requests the server 104 to provide the client device 112 with a code for generating a webpage.
- the server 104 retrieves one or more resources associated with the request and transmits them to the requesting client device 112 .
- the server 104 may respond to an HTTP request by serving an HTML file that represents a webpage.
- the HTML file may reference other resources such as advertisements, images, JavaScript code, or Cascading Style Sheets (“CSS”) that the client device 112 can use to load and present the webpage to a user.
- the web server 104 may provide the referenced files to satisfy the initial request, or may provide the files in response to subsequent requests from the client device 112 .
- the web server 104 can be implemented with various combinations of software and hardware.
- the web server 104 can support services other than or in addition to HTTP, including FTP, SSH, TelNet, and/or IMAP, POP, and SMTP for e-mail services.
- the web server 104 may also support secure connections such as through SSL and HTTPs protocols.
- Various open-source or commercial software products may be used in implementing the web server 104 , such as APACHE web server software or Windows Home Server software.
- the web server 104 can be comprised of one or more computing devices, such as a distributed server system with multiple connected devices that each provide portions of the operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).
- the client computing devices 112 and 114 are capable of communicating information with the web server 104 over a network such as the internet 110 .
- the client devices 112 , 114 can include any of a variety of desktop or mobile devices such as a desktop computer, notebook, smartphone, or tablet.
- the client computing devices may include a network interface card or other hardware for communicating over a wired or wireless network that is connected to the internet 110 .
- the client devices 112 , 114 may also include software, such as a web browser or one or more native applications, to allow a user of the client devices 112 , 114 to request, load, and interact with web resources such as HTML pages and JavaScript applications from one or more websites served by the web server 104 .
- Malware 118 may be present on one or more client devices that communicate with the web server 104 .
- malware 118 has infected the client device 114 , but not client device 112 .
- Malware 118 can include any software that exploits operations of a client or remote computing system such as the web server 104 .
- Malware 118 may engage in various malicious behaviors, including attempts to gather private, digitally-stored information about users such as identification or financial information. Attackers can also use malware 118 to access secure computer systems without authorization, destroy digital information, or gain control of a computer system from an authorized user.
- Malware 118 may include viruses, Trojan horses, spyware, adware, and other malicious software.
- Attackers have developed sophisticated methods to deploy malware 118 on client computing devices 118 without a user's knowledge. For example, using phishing and other social engineering techniques, attackers may deceive users into accessing a resource that installs malware 118 on the user's computing system without notice or detection.
- Some malware 118 can exploit security vulnerabilities in the client device 114 (including in a browser or browsers executing on the client device 114 ) to obtain sensitive user account information and to initiate fraudulent transactions. Attackers may use man-in-the-middle attacks, for instance, to intercept communications between the client device 114 and the web server 104 . Even where a secure communication protocol is used between the client device 114 and the web server 104 , some malware 118 can intercept communications (e.g., after they have been decoded on the client device 114 ), log information about the communications, and even alter such communications. In man-in-the-browser attacks, the malware 118 may compromise a web browser at client device 114 such that the malware 118 activates when a user visits a particular website.
- the malware 118 may access information about the website even after code for the site is decrypted, and in some instances, the malware 118 may inject extra code such as HTML or JavaScript to create malicious forms that prompt users to divulge confidential information that can later be transmitted to attackers for further use.
- Man-in-the-browser malware 118 may also alter an HTTP request from the client device 114 without the user's knowledge to divert a request to an unauthorized server or to implement a fraudulent transaction. For example, in a banking transaction, malware 118 in the client computing device 114 may alter the destination account number in a wire transfer to deliver funds to a mule account rather than an account specified by the user. Some malware 118 may passively reside in the client device 114 to monitor features of a site so that manual or automated attacks on the site's web server 104 can be made at a later time.
- Security intermediary 102 may include one or more computing devices (e.g., physical or virtual server instances) that are situated between the client computing devices 112 , 114 and the web server 104 .
- the security intermediary 102 receives and processes at least a portion of traffic transmitted between the web server 104 and other computing devices that interact with the web server 104 , such as the client devices 112 , 114 .
- the security intermediary 102 may be a physical or virtual subsystem of the web server 104 .
- the security intermediary 102 may be configured to modify and/or analyze web code transmitted to and from the web server 104 to detect alien (i.e., abnormal) or malicious transactions and to obscure operations of the web server 104 by various forms of malware.
- the security intermediary 102 is forwarded or intercepts traffic transmitted from the web server 104 before the traffic is received by a requesting computer device such as client devices 112 or 114 .
- the security intermediary 102 may receive content from the web server 104 through a direct connection with the web server 104 or through a local area network (“LAN”) before transmitting the content over the internet 110 .
- the security intermediary 102 may also receive incoming traffic that is destined for the web server 104 so that it can process the traffic before it is received by the web server 104 .
- the security intermediary 102 may be configured as a reverse proxy server that appears to clients to host and serve a website or other electronic resources as if it were the web server 104 .
- different subserver systems can be used for outgoing service of code and incoming processing of requests, with the subsystems communicating so that one system can provide reverse translations to the translations originally provided by the first subsystem.
- Such coordination may occur, whether a single security subsystem is used or multiple subsystems are used, such as by storing a cookie or similar identifier on client devices 112 , 114 , where the identifier can be used as a public key for performing the transformations (where server-side security for private resources can be reliably maintained).
- the security intermediary 102 may include one or more computing devices that are separate from computing devices of the web server 104 .
- the security intermediary 102 may communicate directly with the web server through a networking cable such as an Ethernet cable or fiber optic line (and typically through many such connections).
- the intermediary 102 can also communicate with the web server 104 through a network such as a local area network (“LAN”).
- LAN local area network
- the intermediary 102 can be installed on the same premises as the web server 104 so that operators or administrators of the web server 104 can also maintain the intermediary 102 locally (particularly for large-volume applications).
- Installing the intermediary 102 in close proximity to the web server 104 can have one or more additional benefits including reduced transmission latency between the intermediary 102 and the web server 104 and increased security that stems from a private connection between the intermediary 102 and the web server 104 that is isolated from public networks such as the internet 110 .
- This configuration can also avoid any need to encrypt communication between the intermediary 102 and the web server 104 , which can be computationally expensive and slow.
- the security intermediary 102 may include one or more computing devices that are separate from the computing devices of the web server 104 , and that are connected to the web server 104 through a public network such as the internet 110 .
- a third-party security company may maintain one or more security intermediaries 102 on the security company's premises.
- the security company may offer services to protect websites and/or web servers 104 from exploitation according to the techniques described herein.
- the security intermediary 102 could then act as a reverse proxy for the web server 104 , receiving outbound traffic from the web server 104 over the internet 110 , processing the traffic, and forwarding the processed traffic to one or more requesting client devices 112 , 114 .
- the intermediary 102 may receive incoming traffic from client devices 112 , 114 over the internet 110 , process the incoming traffic, and forward the processed traffic to the web server 104 over the internet 110 .
- communication between the security intermediary 102 and the web server 104 may be encrypted and secured using protocols such as HTTPS to authenticate the communication and protect against interception or unauthorized listeners over the internet 110 .
- a private line or network may connect the web server 104 to the remote security intermediary 102 , in which case the system 100 may use unencrypted protocols to communicate between the intermediary 102 and web server 104 .
- security intermediary 102 may be a virtual subsystem of web server 104 .
- the one or more computing devices that implement web server 104 may also include software and/or firmware for the security intermediary 102 .
- the system 100 may include the security intermediary 102 as software that interfaces with, and/or is integrated with, software for the web server 104 .
- the software for the security intermediary 102 can first process the request and then submit the processed request to the web server 104 through an API for the web server 104 software.
- the web server 104 responds to a request, the response can be submitted to the security intermediary 102 software through an API for processing by security intermediary 102 before the response is transmitted over the internet 110 .
- two or more security intermediaries 102 may serve the web server 104 . Redundant security intermediaries 102 can be used to reduce the load on any individual intermediary 102 and to protect against failures in one or more security intermediaries.
- the system 100 can also balance traffic among two or more security intermediaries 102 .
- the system 100 may categorize traffic into shards that represent a logical portion of traffic to or from a website. Shards may be categorized according to client identity, network information, URL, the domain or host name in an HTTP request, identity of resources requested from the web server 104 , location of resources requested from the web server 104 , and/or the content of a request or the requested resource 104 .
- the security intermediary 102 can process traffic transmitted to and from the web server 104 . Processing traffic may include analyzing web code to identify alien or malicious activity, reversibly modifying web code to obscure elements of resources provided by the web server 104 , and/or inserting instrumentation code into web code provided by the web server 104 to facilitate detection of alien or malicious activity at the client computing device 112 , 114 .
- the security intermediary 102 can also apply reverse modifications on requests or other information transmitted by client devices 112 , 114 . Reverse modifying of requests can effectively make the security intermediary's 102 operations transparent to the web server 104 . This document sometimes refers to reverse modifications as inverse modifications and these terms are intended to have the same meanings unless indicated otherwise.
- the security intermediary 102 can make various modifications to outgoing web code.
- the security intermediary 102 can make random or pseudo-random changes (both of which are covered by the term “random” in this document unless indicated otherwise) in HTML attribute values in links or forms, which the client 112 , 114 may translate directly into HTTP protocol elements in subsequent requests to the web server 104 .
- a web server 104 for an online retailer at www.examplestore.com can provide a text field in a checkout page for a user at the client device 112 , 114 to input his or her shipping address.
- the security intermediary 102 can replace one or more attributes for the field, such as by generating a pseudo-random value for the ‘name’ attribute to replace ‘shippingaddress.’
- the security intermediary 102 may then forward the modified HTML for the webpage to the client device 114 .
- the client device 114 may then generate HTTP requests for the web server 104 that include the modified attribute, such as in a POST request that references the pseudo-random ‘name’ attribute value.
- the security intermediary 102 When the security intermediary 102 receives the client device 114 POST request, it applies a reverse modification to the attribute value, replacing the pseudo-random value with the original ‘shippingaddress’ value, and then forwards the request to web server 104 .
- the security intermediary 102 may store or access translation tables to apply the reverse modifications, or use encrypted content in information associated with the request to apply reverse modifications. Further explanation and examples of security intermediary 102 operations, including techniques for detection and deflection of unauthorized activity, are discussed in further detail with respect to FIGS. 2-4 .
- the security intermediary 102 can apply different modifications to web code each time the code is served to one or more client devices 112 , 114 . Applying different or unique modifications before the code is ultimately delivered to the client 112 , 114 can frustrate attempts by malware 118 in the client to study and/or exploit the structure of a website or other web application.
- the security intermediary 102 can apply different and unique modifications to the page. Modifications may vary across different users, different clients 112 , 114 , different sessions, and even different page loads for the same user. For example, a user at client device 112 may receive a particular page with one set of modifications during a first session, and different, second set of modifications during a different session.
- the security intermediary 102 may apply different modifications to each resource, even if the users made their requests at substantially the same time.
- the security intermediary 102 creates a moving target that obstructs attempts by malware 118 to determine a “normal” structure of the site or to identify patterns in the structure of a site. Performing such random modifications makes it more difficult for malware 118 to successfully initiate a fraudulent transaction with the web server 104 or otherwise engage in unauthorized activity.
- the modification may be applied according to an initialization vector in the form of a large random number that is generated for each user session with a particular web site.
- the security intermediary 102 may send the modified content along with information for a cookie, where the information allows for the reverse modification of any requests from the client device (e.g., where the requests might include text that has been modified and thus would not be recognizable to the web server).
- the security intermediary may parse the transformation information from the request (e.g., to obtain a nonce and ciphertext) and may uses that information to unmodify any modified text in the request.
- the system 100 may include a load balancer 106 , which can function as a reverse proxy and distribute incoming traffic from client devices 112 , 114 among one or more web servers 104 and/or one or more security intermediaries 102 .
- the load balancer 106 can be connected to a network such as the internet 110 , one or more web servers 104 , and one or more security intermediaries 102 .
- the load balancer 106 analyzes incoming traffic (e.g., traffic destined for the web server 104 ) and may categorize the traffic into shards. Traffic may be distributed, for example, based on a Layer 4 transport or network layer analysis, or based on a Layer 7 application layer analysis.
- FTP requests may be channeled to a web server 104 configured to process FTP requests
- HTTP requests may be channeled to a web server 104 configured to process HTTP requests
- the load balancer 106 may distribute incoming traffic based on the content of an HTTP header or content of the application message itself. For instance, at an online banking website for www.examplebank.com, certain pages on the site may be unrelated to a customer's online banking experience, such as privacy and terms of use pages for the site. At these pages, the customer does not interact with his bank account, and the customer can only consume or request information from the page, but he cannot post information to the web server 104 from that page. These pages may be deemed a low security risk and the load balancer 106 can be configured to identify low risk pages from HTTP requests in incoming traffic. The load balancer 106 may forward low risk traffic directly to the web server 104 and bypass the security intermediary 102 .
- the load balancer 106 can also distribute traffic among multiple security intermediaries 102 .
- incoming traffic can be distributed so that each security intermediary 102 maintains a substantially equal load as the other intermediaries 102 or receives a substantially equal amount of traffic as the other intermediaries 102 .
- incoming traffic may be responsive to previously transmitted web code that had been processed and modified by a particular security intermediary 102 .
- the load balancer 106 may distribute such incoming traffic to the particular security intermediary 102 that generated the previously modified code so that the particular security intermediary 102 can apply a reverse modification to web code in the incoming traffic based on a transformation table that may be stored locally on the particular security intermediary 102 .
- transformation tables may be shared or accessible by one or more other security intermediaries 102 , or modifications may be stateless, so that web code from incoming traffic can be distributed to any intermediary 102 .
- the load balancer 106 may receive the processed traffic from the security intermediary 102 and forward the traffic to the web server 104 .
- the load balancer 106 can also distribute outgoing traffic from the web server 104 for processing by a security intermediary 102 before transmitting the traffic to the client device 112 , 114 . Similar to analyzing incoming traffic, the load balancer 106 may categorize outgoing traffic into shards based on information in the network, transport, or application layers of the traffic. The load balancer 106 may determine that some traffic shards may bypass the security intermediary 102 and may transported over the internet 110 for transmission to a client device 112 , 114 . Other shards may be distributed to one or more security intermediaries 102 for processing.
- the load balancer 106 may distribute outgoing traffic to maintain generally equivalent loads among the multiple intermediaries 102 .
- the security intermediaries 102 can then transmit processed traffic back to the load balancer 106 for delivery to client devices 112 , 114 over the internet 110 .
- a configuration module 120 can be used to monitor the system 100 and to configure various aspects of the system's 100 operation.
- An administrator can use the configuration module 120 to provide system updates, change and load one or more system policies, manage users, select an operation mode, define how to handle exceptions, and/or monitor the health and status of the system 100 .
- an administrator may use the configuration module 120 to update system software to improve the performance and security of the system.
- malware 118 designers may attempt to learn about the system 100 and exploit any detected security vulnerabilities.
- the system 100 including, for example, the security intermediary 102 , can be updated with new software that patches security vulnerabilities and improves system performance.
- New features may also be introduced such as new algorithms for modifying web code or implementing instrumentation code.
- the administrator can also use the configuration module 120 to select or change different system policies. For example, particular modification modes may be selected.
- the administrator can choose whether the security intermediaries 102 should apply modification techniques that involve only modifying a web application's implicit API (e.g., form fields, links, AJAX calls), for example, or if instrumentation code or other content should be supplemented with the web code.
- the administrator can also configure how sessions are managed. For example, the security intermediary 102 can be configured to apply a unique session ID each time a client device 112 , 114 makes a new request for a web application, or a particular session can be made to last across multiple requests, such as when a user browses multiple pages while logged into a secure account.
- the configuration module 120 can also facilitate management of resource families, which are categories of requests and electronic content for which a particular security policy applies.
- the system 100 may allow one or more resource families to bypass operations of the security intermediary 102 , while resources in other families must pass through the security intermediary 102 for modification or analysis before being delivered to a client device 112 , 114 .
- resource families can be defined by directories, uniform resource indicators (URIs), uniform resource locators (URLs), subdomains, or other logical locations of particular resources on a site that is served by the web server 104 . If a web serve 104 serves multiple sites or multiple domains, different policies may apply among the different sites and/or domains.
- An administrator can create, modify and remove resource policies at the configuration module 120 , and can indicate which security policy or policies to apply to various families.
- An administrator 120 can also configure how the system 100 should apply various security policies based on factors other than or in addition to resource families. For instance, different policies may apply based on characteristics of the device that is making the request or the network on which the requesting device is on.
- the security intermediary 102 may determine identities of client devices 112 , 114 for which a security threat has previously been identified, or it may recognize an account of a user that has previously been associated with security threats.
- the administrator may configure the system 100 to apply more restrictive security policies to particular requesting client devices 112 , 114 or users than would otherwise apply based on the family of the requested resource alone.
- the configuration module 120 can change operating modes in the security intermediary 102 and/or adjust the security policy of one or more resource families, clients, or networks.
- the security intermediary 102 may be capable of various modification modes that the administrator can apply to a resource family, for example. In some modes, very subtle modifications may be made to elements of the web code in order to detect anomalous or malicious activity, whereas other modes may apply increasingly more complex or widespread modifications that are aimed at preventing unauthorized activity. In some implementations, policy settings or mode changes can be triggered automatically by the configuration module 120 .
- the configuration module 120 can also allow an administrator to specify how the security intermediary 102 should respond to exceptions. Exceptions can relate to internal system errors or to detection of fraud, malware, abnormal behavior, and/or malicious activity in traffic received from a client device 112 , 114 . Internal system errors may be logged and transmitted to security server 108 for further analysis or storage. For instances of detected fraud, malware, or alien or malicious web code, the security intermediary 102 can be configured to respond in one or more ways. The intermediary 102 may log the event and transmit it to security server 108 for further analysis. In some implementations, the security intermediary 102 may alert the web server 104 of suspected unauthorized activity, so that the web server 104 can respond in a particular way.
- the system 100 can be configured to process the transaction normally, log the transaction, and alert various parties or authorities.
- the transaction can be thwarted if the security intermediary 102 is configured to alert the web server 104 .
- the web server 104 can respond to a fraud alert by generating a web resource for delivery to an infected or fraudulent client device 114 that indicates the transaction was processed as requested, when in fact it was not.
- the administrator may also manage users at the configuration module. For example, various user categories may provide system users with varying levels of use and access privileges to the system 100 .
- the system 100 may provide four user categories: super-users, system operators, analysts, and auditors.
- Super-users can create other users and are able to access and perform any action provided for by the system 100 .
- the administrator may be a super-user, for instance.
- System operators can configure the system 100 and view data from the system 100 , but cannot manage other users.
- Analysts can view data from the system 100 , but they cannot modify the system's configuration.
- an auditor can view a limited set of system data such as how the system was used and by whom.
- the configuration module 120 can also provide a portal for various other system settings such as those that may be required for installation and setup of the security intermediary 102 , or to configure a particular system setup, such as registration with a security server 108 , interoperability with the load balancer 106 , and arrangements of multiple security intermediaries 102 .
- the configuration module 120 can be accessible at a terminal on the premises of the security intermediary 102 and can be separate from or integrated with the security intermediary 102 . In some implementations, the configuration module 120 can be accessible remotely, such as through an interface at a desktop or mobile computing device that can communicate with the security intermediary 102 through a network.
- Information about security events can be forwarded to the security server 108 .
- the security server 108 can be dedicated to events received from one or more security intermediaries 102 that serve a particular web server 104 .
- the security server 108 can be a centralized server that receives security event information from a plurality of security intermediaries 102 that serve multiple web servers 104 and/or websites.
- Information on security events 108 from multiple sites can be analyzed in aggregate to study developing security threats, determine whether some anomalous activity may nevertheless be benign (such as traces from an authorized or legitimate browser plug-in), to publish statistics or report information on security events to interested parties, and/or to use in developing updates and improvements to the system 100 for increased performance and security.
- the security server 108 can analyze information from across multiple computing sessions and/or multiple clients as well.
- the security server 108 can also receive operating information from the security intermediary 102 that can be used to monitor system performance. For instance, the security intermediary 102 may track and report information about the speed and volume of modifications that it makes to web code, or information about its usual and peak operating levels. The information can be used to make or recommend system configurations to optimize performance and to compare information from multiple security intermediaries 102 deployed across multiple web servers 104 .
- Communication between the security intermediary 102 and the client devices 112 , 114 can occur over one or more networks, including the internet 110 .
- each client computing device 112 and 114 may connect to a network such as a local area network (“LAN”) or a wide area network (“WAN”) that is in turn connected to the security intermediary 102 through the internet 110 .
- the system 100 may be installed on a private network rather than, or in addition to, the internet 110 . Communications over the internet 110 can be encrypted and verified such as with HTTPS and Secure Sockets Layer (“SSL”) protocols.
- SSL Secure Sockets Layer
- the webpage 116 A may implement the form with HTML tags such as ⁇ form> and ⁇ input> tags that are each identified by a name. For instance, the destination account field is named “money_dest.”
- the client devices 112 and 114 can use the names in submitting form data to the web server 104 through a GET or POST HTTP request method, for example.
- the page 116 A is directed to the security intermediary 102 .
- the load balancer 106 may determine which security intermediary 102 to direct the webpage 116 A to in implementations where there may be multiple, redundant security intermediaries 102 .
- a policy engine at the security intermediary 102 may determine how the security intermediary 102 will process the webpage 116 A. For example, the policy engine may determine that the webpage 116 A, which pertains to sensitive financial transactions, is part of a resource family that the intermediary 102 has been configured to modify and to insert instrumentation code. Other resources from the banking site, such as its homepage, may contain less sensitive information and may be subject to lower-level security policies such that the security intermediary 102 may handle the homepage with less sensitivity than the wire transfer webpage 116 A.
- the security intermediary 102 processes the webpage 116 A according to the governing security policy and transmits processed webpage 116 B to client devices 112 and 114 .
- the security intermediary 102 may modify elements of the webpage's 116 A implicit API, such as field names, function names, and link references.
- the security intermediary 102 changes the name of the destination account field in webpage 116 A from “money_dest” to “x1$v4.” The name change obscures the identity of the field to prevent malware 118 from learning how to exploit the field.
- the security intermediary 102 can insert instrumentation code into the webpage that can detect certain activity that may indicate alien content (e.g., malware 118 or legitimate code on a client device 112 or 114 that interacts with a web page such as a browser plug-in), and can report the detected activity back to the security intermediary 102 and/or a central security server 108 .
- alien content e.g., malware 118 or legitimate code on a client device 112 or 114 that interacts with a web page such as a browser plug-in
- Instrumentation code may also collect information about particular activity that occurs on the client device 112 and/or 114 .
- the instrumentation code may collect information about how a user interacts with the web page such as key strokes, mouse movements, changes in focus between particular forms, fields, or frames, and patterns and timing of interactions with the page.
- Information about the user's operating environment may also be collected, such as network configurations, operating system information, hardware specifications, performance indicators, session identifiers, other cookies, browser type, browser settings, IP address, MAC address, client device type, plug-ins, screen resolution, installed fonts, timestamp, site or page identifier, GPS data, etc.
- users and system operators can configure the instrumentation code to restrict or anonymize the data that it gathers to respect user privacy.
- the security intermediary 102 can also include an identifier, such as a session identifier in a cookie, with the processed web page 116 B.
- the security intermediary 102 can store the identifier in a data structure, table, or database that correlates the original web code with the modified web code for a particular resource so that the security intermediary 102 can apply reverse modifications to requests based on modified resources before forwarding the request to the web server 104 .
- the security intermediary 102 may assign a unique identifier to the webpage 116 A, and store the identifier in a table that associates the resource's original field name, “money_dest,” with the modified field name “x1$v4.” Later transactions posted to the web server 104 from the modified page 116 B can be received by the security intermediary 102 for reverse modification before forwarding the request to the web server 104 .
- the security intermediary 102 can determine which reverse modifications to apply based on the identifier.
- the identifier can be a session identifier.
- client device 112 has received the modified (i.e., processed) web code of web page 116 B.
- Client device 112 is a clean device in that no malware 118 that is configured to attack the online banking website has infected the device 112 .
- a user at the client device 112 provides into the fields on the web page 116 B the necessary information to complete a wire transfer, such as an indication of the source account, destination account, and transfer amount.
- the user may then submit the request for a wire transfer, which a browser on the client device 112 converts into an HTTP request to the web server 104 that includes the information submitted by the user with corresponding field names.
- the HTTP request from client device 112 uses the random field name that the security intermediary 102 generated for the destination account field, “x1$v4.”
- Instrumentation code 1128 can monitor the webpage 116 B on client device 112 .
- the instrumentation code 1128 may determine that malware 118 or other anomalous activity has altered the webpage 116 B and may be attempting to initiate an unauthorized transaction.
- the instrumentation code 1128 may include information about the modified web code for web page 116 B, and may be programmed to detect when elements of the modified code are altered at the client device 112 .
- the instrumentation code may determine whether the document object model (“DOM”) for the webpage has been altered, or if the HTTP request based on the webpage uses unexpected values that do not correspond to the modified web code delivered in web page 116 B.
- the instrumentation code may detect that the client device 114 has called an original function value rather than its modified, replaced value.
- Malicious activity can be both detected and deflected in relatively sophisticated manners by changing the environment in which executable code on the client device, such as JavaScript, operates. Detection can occur by identifying certain JavaScript operations or calls that may be made on a page, and instrumenting code that is served with a web page so as to report to a security server system when such operations occur and/or such calls are made (along with information that describes the actions). Deflection occurs by the constant changing of code elements as they are served each time, such as changing the names of elements that will be called by malicious JavaScript, so that the malicious code can never catch up with the changes and thus gives itself away when it tries to interoperate with code known by the system to be stale.
- a common method for making changes to a DOM for a web page is the document.write method, and may be used by malicious code to surreptitiously change what the user of a computing device sees on a web page.
- a security system can (1) instrument served code corresponding to such a method so that the instrumentation code reports calls to the method, and additionally includes data that characterizes such calls, so that the system can detect abnormal activity and perhaps use the additional data to determine whether the abnormal activity is malicious or benign; and (2) change the function name to “document.#3@1*87%5.write” or some other legal name that includes random text that can be changed automatically each time the code is served.
- Such constant changing creates a real challenge for a malicious party seeking to write code that can keep up with the changes, and also flags the presence of the malicious code when it attempts to interact with an outdated method name, and is reported by the instrumentation code.
- Other examples of JavaScript actions that can be instrumented and continually changed include “getElementById,” “getElementByName,” XPath commands, and setting of HTML elements in the DOM to particular values.
- the code may collect information that characterizes events and statuses of a web page or other resource as described, and may report the information in various manners.
- the instrumentation reports that includes such information can be sent to the security server 108 and/or the security intermediary 102 .
- the security server 108 may receive instrumentation reports directly from the client devices 112 , 114 , or indirectly through the security intermediary 102 .
- the instrumentation code may generate and transmit reports periodically or upon request, for instance. Reports can also be transmitted in subsequent HTTP requests from the client device 112 , 114 to the web server 104 , and can be received by the security intermediary 102 .
- instrumentation reports can be sent to the security intermediary 102 or security server 108 asynchronously, such as through the use of AJAX or WebSocket.
- malware 118 has not interfered with the transaction, and the HTTP request includes the appropriate modified field names such as “x1$v4” for the “money_dest” field. Therefore, the instrumentation code 1128 does not report the presence of anomalous or malicious activity to the security intermediary 102 .
- client device 114 is shown to have received the modified (i.e., processed) web code for web page 116 B.
- client device 114 is compromised with malware 118 , such as a man-in-the-browser bot.
- malware 118 may intervene and replace the destination account field name with “money_dest”—the original field name before the security intermediary 102 modified web page 116 A.
- the bot may use the original field name, for example, based on previous analysis of the banking website in instances where the security intermediary 102 did not modify the field name.
- the instrumentation code 114 B can detect the behavior or consequences of the behavior of malware 118 , and generate a report to alert the security intermediary 102 and/or the web server 104 of suspicious activity.
- the instrumentation code 114 B in FIG. 1B reports the suspicious activity by causing the HTTP request that the user submits for the transaction to include the field name “x1$v4*” in place of the malware's 118 field name “money_dest.”
- the asterisk appended to the end of the modified field name indicates that the instrumentation code 114 B detected suspicious activity.
- the security intermediary 102 receives the HTTP requests for the wire-transfer transaction from client devices 112 and 114 , decodes the requests, and forwards the decoded requests to the web server 104 .
- the HTTP requests from the client devices 112 and 114 may include a cookie having a session identifier that the security intermediary 102 can use in decoding the HTTP requests.
- the security intermediary 102 can lookup the session identifier in a translation table, and decode the request by applying reverse modifications that restore the original field and function names, for example.
- the intermediary 102 receives the substitute field name “x1$v4” as expected, decodes the field name by replacing it with “money_dest” and forwards the request to the web server 104 through the load balancer 106 .
- the operation of security intermediary 102 is transparent to the web server 104 , and the web server 104 can process the transaction according to the user's request.
- the security intermediary 102 recognizes the instrumentation code's 114 report of suspicious activity, and sends an alert to the web server 104 .
- the security intermediary 102 can use the session identifier in the HTTP request to determine the appropriate reverse modifications necessary to decode the request.
- the security intermediary 102 may recognize that the field name “x1$v4*” corresponds to the original “money_dest” field name, but that the instrumentation code 114 B appended an asterisk to the field name to indicate possibly malicious activity.
- the security intermediary 102 can respond to the indication in various ways according to the applicable security policy and/or system configuration settings.
- the intermediary 102 forwards the decoded request to the web server 104 , but appends the asterisk to the destination account field name, “money_dest*,” to notify the web server 104 that the transaction is suspicious, and may indicate the presence of unauthorized alien content.
- the web server 104 may ignore the alert, complete the transaction and log the alert, refuse to complete the transaction, pretend to complete the transaction, and/or take other appropriate action.
- the security intermediary 102 may not forward the transaction request to the web server 104 if suspicious activity has been detected.
- the security intermediary 102 may forward information about the transactions between the web server and the client devices 112 and/or 114 to the security server 108 .
- the security intermediary 102 may share information about the transaction from client device 114 in which the instrumentation code 114 B reported suspicious activity.
- the instrumentation code 114 B may include a report about the detected suspicious activity and its circumstances that the security intermediary 102 can provide to the security server 108 .
- the report may include information about the client device 114 , the abnormal or suspicious activity, the electronic resources and fields involved, and information about the browser, operating system, or other application that the malware 118 may have compromised.
- Data from the security server 108 can be analyzed with respect to the security intermediary 102 for a particular site, or in aggregate with information from other security intermediaries 102 that serve other websites and web servers 104 .
- the security server 108 can analyze data across multiple computing sessions and for multiple client devices. The analysis from the security server 108 can be used, for instance, to identify new threats, track known threats, and to distinguish legitimate abnormal or alien activity from malicious activity.
- FIG. 2 is a schematic diagram of a system 200 for performing deflection and detection of malicious activity with respect to a web server system.
- the system may be the same as the system 100 discussed with respect to FIGS. 1A and 1B , and is shown in this example to better explain the interrelationship of various general features of the overall system 200 , including the use of instrumentation code for detection and deflection that is discussed in greater detail throughout this document.
- the system 200 in this example is a system that is operated by, or for, a large number of different businesses that serve web pages and other content over the internet, such as banks and retailers that have on-line presences (e.g., on-line stores, or on-line account management tools).
- the main server systems operated by those organizations or their agents are designated as web servers 204 a - 204 n , and could include a broad array of web servers, content servers, database servers, financial servers, load balancers, and other necessary components (either as physical or virtual servers).
- a set of security server systems 202 a to 202 n are shown connected between the web servers 204 a to 204 n and a network 210 such as the internet. Although both extend to n, the actual number of sub-systems could vary. For example, certain of the customers could install two separate security server systems to serve all of their web server systems (which could by one or more), such as for redundancy purposes.
- the particular security server systems 202 a - 202 n may be matched to particular ones of the web server systems 204 a - 204 n , or they may be at separate sites, and all of the web servers for various different customers may be provided with services by a single common set of security servers 202 a - 202 n (e.g., when all of the server systems are at a single co-location facility so that bandwidth issues are minimized).
- Each of the security server systems 202 a - 202 n may be arranged and programmed to carry out operations like those discussed above and below and other operations.
- a policy engine 220 in each such security server system may evaluate HTTP requests from client computers (e.g., desktop, laptop, tablet, and smartphone computers) based on header and network information, and can set and store session information related to a relevant policy.
- the policy engine may be programmed to classify requests and correlate them to particular actions to be taken to code returned by the web server systems before such code is served back to a client computer.
- the policy information may be provided to a decode, analysis, and re-encode module, which matches the content to be delivered, across multiple content types (e.g., HTML, JavaScript, and CSS), to actions to be taken on the content (e.g., using XPATH within a DOM), such as substitutions, addition of content, and other actions that may be provided as extensions to the system.
- the different types of content may be analyzed to determining naming that may extend across such different pieces of content (e.g., the name of a function or parameter), and such names may be changed in a way that differs each time the content is served, e.g., by replacing a named item with randomly-generated characters.
- Elements within the different types of content may first be group as having a common effect on the operation of the code, and then may be re-encoded together in a common manner so that their interoperation with each other will be consistent even after the re-encoding.
- a rules engine 222 may story analytical rules for performing such analysis and for re-encoding of the content.
- the rules engine may be populated with rules developed through operator observation of particular content types, such as by operators of a system studying typical web pages that call JavaScript content and recognizing that a particular method is frequently used in a particular manner. Such observation may result in the rules engine 222 being programmed to identify the method and calls to the method so that they can all be grouped and re-encoded in a consistent and coordinated manner.
- the decode, analysis, and re-encode module 224 encodes content being passed to client computers from a web server according to relevant policies and rules.
- the module 224 also reverse encodes requests from the client computers to the relevant web server.
- a web page may be served with a particular parameter, and may refer to JavaScript that references that same parameter.
- the decode, analysis, and re-encode module 224 may replace the name of that parameter, in each of the different types of content, with a randomly generated name, and each time the web page is served, the generated name may be different.
- the name of the parameter is passed back to the web server, it may be re-encoded back to its original name so that this portion of the security process may occur seamless for the web server.
- a key for the function that encodes and decodes such strings can be maintained by the security server system 202 along with an identifier for the particular client computer so that the system 202 may know which key or function to apply, and may otherwise maintaining a state for the client computer and its session.
- a stateless approach may also be employed, whereby the security server system 202 encrypts the state and stores it in a cookie that is saved at the relevant client computer. The client computer may then pass that cookie data back when it passes the information that needs to be decoded back to its original status. With the cookie data, the system 202 may use a private key to decrypt the state information and use that state information in real-time to decode the information from the client computer.
- Such a stateless implementation may create benefits such as less management overhead for the server system 202 (e.g., for tracking state, for storing state, and for performing clean-up of stored state information as sessions time out or otherwise end) and as a result, higher overall throughput.
- An instrumentation module 226 is programmed to add active code to the content that is served from a web server.
- the instrumentation is code that is programmed to monitor the operation of other code that is served. For example, the instrumentation may be programmed to identify when certain methods are called, when those methods have been identified as likely to be called by malicious software. When such actions are observed by the instrumentation code to occur, the instrumentation code may be programmed to send a communication to the security server reporting on the type of action that occurred and other meta data that is helpful in characterizing the activity. Such information can be used to help determine whether the action was malicious or benign.
- the instrumentation code may also analyze the DOM on a client computer in predetermined manners that are likely to identify the presence of and operation of malicious software, and to report to the security servers 202 or a related system.
- the instrumentation code may be programmed to characterize a portion of the DOM when a user takes a particular action, such as clicking on a particular on-page button, so as to identify a change in the OM before and after the click (where the click is expected to cause a particular change to the DOM if there is benign code operating with respect to the click, as opposed to malicious code operating with respect to the click).
- Data that characterizes the DOM may also be hashed, either at the client computer or the server system 202 , to produce a representation of the DOM that is easy to compare against corresponding representations of DOMs from other client computers.
- Other techniques may also be used by the instrumentation code to generate a compact representation of the DOM or other structure expected to be affected by malicious code in an identifiable manner.
- the content from web servers 204 a - 204 n may be rendered on web browsers of various client computers.
- Uninfected clients computers 212 a - 212 n represent computers that do not have malicious code programmed to interfere with a particular site a user visits or to otherwise perform malicious activity.
- Infected clients computers 214 a - 214 n represent computers that do have malicious code ( 218 a - 218 n , respectively) programmed to interfere with a particular site a user visits or to otherwise perform malicious activity.
- the client computers 212 , 214 may also store the encrypted cookies discussed above and pass such cookies back through the network 210 .
- the client computers 212 , 214 will, once they obtain the served content, implement DOMs for managing the displayed web pages, and instrumentation code may monitor the DOM as discussed above. Reports of illogical activity (e.g., software on the client device calling a method that does not exist in the downloaded and rendered content)
- each web site operator may be provided with a single security console 207 that provides analytical tools for a single site or group of sites.
- the console 207 may include software for showing groups of abnormal activities, or reports that indicate the type of code served by the web site that generates the most abnormal activity.
- a security officer for a bank may determine that defensive actions are needed if must of the reported abnormal activity for its web site relates to content elements corresponding to money transfer operations—an indication that stale malicious code may be trying to access such elements surreptitiously.
- a central security console may connect to a large number of web content providers, and may be run, for example, by an organization that provides the software for operating the security server systems 202 a - 202 n .
- Such console 208 may access complex analytical and data analysis tools, such as tools that identify clustering of abnormal activities across thousands of client computers and sessions, so that an operator of the console 208 can focus on those cluster in order to diagnose them as malicious or benign, and then take steps to thwart any malicious activity.
- the console 208 may have access to software for analyzing telemetry data received from a very large number of client computers that execute instrumentation code provided by the system 200 .
- Such data may result from forms being re-written across a large number of web pages and web sites to include content that collects system information such as browser version, installed plug-ins, screen resolution, window size and position, operating system, network information, and the like.
- user interaction with served content may be characterized by such code, such as the speed with which a user interacts with a page, the path of a pointer over the page, and the like.
- Such collected telemetry data may be used by the console 208 to identify what is “natural” interaction with a particular page and what is “unnatural” interaction that is likely the result of a bot interacting with the content.
- Statistical and machine learning methods may be used to identify patterns in such telemetry data, and to resolve bot candidates to particular client computers. Such client computers may then be handled in special manners by the system 200 , may be blocked from interaction, or may have their operators notified that their computer is running bad software.
- FIG. 3 is a flow chart of a process for transforming code passed over the internet.
- the process involves receiving content to be served to a client device and transforming that content so as to obscure the operation of the webpage that serves the content, so that malicious code cannot attempt to take advantage of such operation of the webpage.
- the process also involves receiving requests from a client to which the content was served, and using information passed with the request to reverse transform the provided content, and then provide that transformed content to a Web server that serves the original webpage.
- the process begins a box at 302 , where code to be served is received, such as from a web server that is connected to a security server system.
- the security server system modifies the code to obscure its operation. For example, as discussed above, names of methods, functions, parameters, and other items may be changed into seemingly random strings of text, where the changes are made consistently across HTML code, CSS code, and JavaScript code, so that calls between the different types of codes can be properly answered after the transformation (e.g., when the types of code are executed on the client device).
- the transformation information is generated. Generally, such information would be generated before the modification so that it could be used in performing the modification, such as by providing the transformation information to a function that transforms the content and uses the provided information as a parameter for the transformation.
- the step here involves taking the transformation information and packaging it for transmission to the client device.
- the modified code and the transformation information are served to the client device. Such service involves transmission in a single communication, or the transformed content may be provided separately from the transformation information.
- the transformation information may be provided in a manner that it will exhibit its self as a cookie or similar item on the client device.
- the system receives a subsequent request from the client device.
- the request may take a variety of forms, and may be generated as a result of a user interaction with the web page that was served to the client device. For example, perhaps a user of the client device chooses to enter text into a form on his or her bank web page so as to transfer funds between accounts.
- a request may be sent back to the Web server for the bank and be intercepted by a security subsystem.
- the request may have the transformation information appended to it, and the security subsystem may use such transformation information in the same manner it was used when initially transforming the content to be served.
- the transformation is operated in the reverse direction, so that transformed text may be reverted to its original form that was served by the Web server.
- the received request is unpacked and decoded, and it least a portion of the request is passed to the Web server in its reverse transformed format.
- FIG. 4 shows a process for encryption.
- the process generally follows the format of AES encryption using CCM block mode (e.g., RFC 3610 and NIST special publication 800-38C), to provide both assurance and confidentiality and authenticity of a serialized data structure provided to the client device.
- CCM block mode e.g., RFC 3610 and NIST special publication 800-38C
- This is the same block mode used for WPA2 in the IEEE 802.11i standard.
- the use of the nonce as illustrated in the earlier example case is required for the CCM block mode of operation.
- the nonce is not a secret, but should have a very high probability of being unique and be unpredictable.
- a 112 bit random number provides sufficient probability and leaves 16 bits for the counter in a 128 bit block.
- the nonce should be passed in the clear, as it is required (in addition to the key) to decrypt the ciphertext.
- all security servers for a given web site share a common, but randomly chosen, 256 bit key.
- the potential for replay attacks from storing information at a client device can be mitigated by (a) including a timestamp in the encrypted cookie, so that GETs/POSTs received after a reasonable amount of time are simply ignored; and (2) keeping at each security server a circular buffer of processed (received) nonces, so that the servers refuse subsequent GETs/POSTs reusing the same nonce. Nonces in the buffer older than the timeout value can be discarded.
- FIG. 5 is a schematic diagram of a computer system 500 .
- the system 500 can be used for the operations described in association with any of the computer-implement methods described previously, according to one implementation.
- the system 500 is intended to include various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers.
- the system 500 can also include mobile devices, such as personal digital assistants, cellular telephones, smartphones, and other similar computing devices.
- the system can include portable storage media, such as, Universal Serial Bus (USB) flash drives.
- USB flash drives may store operating systems and other applications.
- the USB flash drives can include input/output components, such as a wireless transmitter or USB connector that may be inserted into a USB port of another computing device.
- the system 500 includes a processor 510 , a memory 520 , a storage device 530 , and an input/output device 540 .
- Each of the components 510 , 520 , 530 , and 540 are interconnected using a system bus 550 .
- the processor 510 is capable of processing instructions for execution within the system 500 .
- the processor may be designed using any of a number of architectures.
- the processor 510 may be a CISC (Complex Instruction Set Computers) processor, a RISC (Reduced Instruction Set Computer) processor, or a MISC (Minimal Instruction Set Computer) processor.
- the processor 510 is a single-threaded processor. In another implementation, the processor 510 is a multi-threaded processor.
- the processor 510 is capable of processing instructions stored in the memory 520 or on the storage device 530 to display graphical information for a user interface on the input/output device 540 .
- the memory 520 stores information within the system 500 .
- the memory 520 is a computer-readable medium.
- the memory 520 is a volatile memory unit.
- the memory 520 is a non-volatile memory unit.
- the storage device 530 is capable of providing mass storage for the system 500 .
- the storage device 530 is a computer-readable medium.
- the storage device 530 may be a floppy disk device, a hard disk device, an optical disk device, or a tape device.
- the input/output device 540 provides input/output operations for the system 500 .
- the input/output device 540 includes a keyboard and/or pointing device.
- the input/output device 640 includes a display unit for displaying graphical user interfaces.
- the features described can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them.
- the apparatus can be implemented in a computer program product tangibly embodied in an information carrier, e.g., in a machine-readable storage device for execution by a programmable processor; and method steps can be performed by a programmable processor executing a program of instructions to perform functions of the described implementations by operating on input data and generating output.
- the described features can be implemented advantageously in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device.
- a computer program is a set of instructions that can be used, directly or indirectly, in a computer to perform a certain activity or bring about a certain result.
- a computer program can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.
- Suitable processors for the execution of a program of instructions include, by way of example, both general and special purpose microprocessors, and the sole processor or one of multiple processors of any kind of computer.
- a processor will receive instructions and data from a read-only memory or a random access memory or both.
- the essential elements of a computer are a processor for executing instructions and one or more memories for storing instructions and data.
- a computer will also include, or be operatively coupled to communicate with, one or more mass storage devices for storing data files; such devices include magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and optical disks.
- Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.
- semiconductor memory devices such as EPROM, EEPROM, and flash memory devices
- magnetic disks such as internal hard disks and removable disks
- magneto-optical disks and CD-ROM and DVD-ROM disks.
- the processor and the memory can be supplemented by, or incorporated in, ASICs (application-specific integrated circuits).
- ASICs application-specific integrated circuits
- the features can be implemented on a computer having a display device such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the user and a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer. Additionally, such activities can be implemented via touchscreen flat-panel displays and other appropriate mechanisms.
- a display device such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the user and a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer.
- a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer.
- activities can be implemented via touchscreen flat-panel displays and other appropriate mechanisms.
- the features can be implemented in a computer system that includes a back-end component, such as a data server, or that includes a middleware component, such as an application server or an Internet server, or that includes a front-end component, such as a client computer having a graphical user interface or an Internet browser, or any combination of them.
- the components of the system can be connected by any form or medium of digital data communication such as a communication network. Examples of communication networks include a local area network (“LAN”), a wide area network (“WAN”), peer-to-peer networks (having ad-hoc or static members), grid computing infrastructures, and the Internet.
- LAN local area network
- WAN wide area network
- peer-to-peer networks having ad-hoc or static members
- grid computing infrastructures and the Internet.
- the computer system can include clients and servers.
- a client and server are generally remote from each other and typically interact through a network, such as the described one.
- the relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
- the subject matter may be embodied as methods, systems, devices, and/or as an article or computer program product.
- the article or computer program product may comprise one or more computer-readable media or computer-readable storage devices, which may be tangible and non-transitory, that include instructions that may be executable by one or more machines such as computer processors.
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Software Systems (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Physics & Mathematics (AREA)
- General Health & Medical Sciences (AREA)
- Virology (AREA)
- Health & Medical Sciences (AREA)
- Multimedia (AREA)
- Technology Law (AREA)
- Databases & Information Systems (AREA)
- Data Mining & Analysis (AREA)
- Information Transfer Between Computers (AREA)
- Computer And Data Communications (AREA)
Abstract
Description
- This application claims priority under 35 U.S.C. §119(e)(1), to U.S. Provisional Application Ser. No. 61/801,142, filed on Mar. 15, 2013, the entire contents of which are incorporated herein by reference.
- This document generally relates to computer security, and more specifically to efforts to prevent malware from automatically attacking web and other content.
- Computer fraud is big business both for the fraudsters and the people who try to stop them. One common area of computer fraud involves attempts by organizations to infiltrate computers of ordinary people, and by that action to trick those people into giving up confidential information, such as credit card information and access codes. For example, via an exploit commonly termed “Man in the Browser,” a user's computer can be provided with code that intercepts legitimate communications by the user, such as with the user's bank, and does so after the communications have been decrypted, e.g., by a web browser on the computer. Such code may alter the interface that the user sees, such as by generating an interface that looks to the user like their bank is requesting particular information (e.g., a PIN number) when in fact the bank would never request such information via a web page. Alternatively, the code may generate an interface that indicates to a user that a banking or shopping transaction was executed as the user requested, when in fact, the illegal organization altered the transaction so as to send the user's money to an entity associated with the organization.
- Various approaches have been taken to identify and prevent such malicious activity. For example, programs have been developed for operation on client computers or at the servers of the organizations that own and operate the client computer to detect improper activity.
- This document describes systems and techniques by which web code (e.g., HTML, CSS, and JavaScript) is modified before it is served over the internet by a server system so as to make more difficult the exploitation of the server system by clients that receive the code (including clients that are infected without their users' knowledge). The modifications may differ for different times that a web page and related content are served, whether to the same client computer or to different client computers. Specifically, two different users (or a single user in two different web browsing sessions) may be served slightly different code in response to the same requests, where the difference may be in implicit parts of the code that are not displayed so that the differences are not noticeable to the user or users. For example, the names that are served to a client device for various software objects may be changed in essentially random ways each time a page is served. A main purpose of such action is to create a moving target with the code, so that malicious code cannot use predictability of the code in order to interact with the content in a malicious way. In one example, changing the code served to client devices in an essentially random manner each time the code is served can deter malicious code executing on the client computers (e.g., Man in the Browser bot) from interacting with the served code in a predictable way so as to trick a user of the client computer into providing confidential financial information and the like. Moreover, external programs generally cannot drive web application functionality directly, and so preventing predictable interaction with served code can be an effective means of preventing malicious computer activity.
- In general, creating a moving, unpredictable target by modifying aspects of web code each time it is served can prevent or deter a wide variety of computer attacks. For example, such techniques can be used to combat credential stuffing, in which malicious parties obtain leaked or cracked user credentials for a given web service and then use automated bots to perform credential testing at other websites or services based on the illicitly obtained credentials. By changing the content and structure of the web code each time it served, bots that seek to either listen for user credentials or to perform automated credential testing may be thwarted by random changes in the web code that significantly complicate the bot's task of determining how to effectively interact with the web code.
- Likewise, other forms of computer attacks can also be prevented or deterred by the web code transformations described in this document. Some of these attacks include: (a) denial of service attacks, and particularly advanced application denial of service attacks, where a malicious party targets a particular functionality of a website (e.g., a widget or other web application) and floods the server with requests for that functionality until the server can no longer respond to requests from legitimate users; (b) rating manipulation schemes in which fraudulent parties use automated scripts to generate a large number of positive or negative reviews of some entity such as a marketed product or business in order to artificially skew the average rating for the entity up or down; (c) fake account creation in which malicious parties use automated scripts to establish and use fake accounts on one or more web services to engage in attacks ranging from content spam, e-mail spam, identity theft, phishing, ratings manipulation, fraudulent reviews, and countless others; (d) fraudulent reservation of rival goods, where a malicious party exploits flaws in a merchant's website to engage in a form of online scalping by purchasing all or a substantial amount of the merchant's inventory and quickly turning around to sell the inventory at a significant markup; (e) ballot stuffing, where automated bots are used to register a large number of fraudulent poll responses; (f) website scraping, where both malicious parties and others (e.g., commercial competitors), use automated programs to obtain and collect data such as user reviews, articles, or technical information published by a website, and where the scraped data is used for commercial purposes that may threaten to undercut the origin website's investment in the scraped content; and (g) web vulnerability assessments in which malicious parties scan any number of websites for security vulnerabilities by analyzing the web code and structure of each site.
- The systems, methods, and techniques for web code modifications described in this paper can prevent or deter each of these types of attacks. For example, by randomizing the implicit references in web code that may be used for making requests to a web server or by randomly injecting distracter fields into the code that were not originally part of the code provided by the web server, the effectiveness of bots and other malicious automated scripts is substantially diminished.
- As such, malicious activity can be both deflected and detected in relatively sophisticated manners by changing the environment in which executable code on the client device, such as JavaScript, operates (in addition to changing corresponding references in the HTML code). Deflection occurs by the constant changing of code elements as they are served each time, such as changing the names of elements that will be called by malicious JavaScript, so that the malicious code can never catch up with the changes, and thus gives itself away when it tries to interoperate with code known by the system to be stale. Detection can occur by identifying certain JavaScript operations or calls that may be made on a page, and instrumenting code that is served with a web page so as to report to a security server system when such operations occur and/or such calls are made (along with information that describes the actions). Specifically, malicious code may try to call an item that it believes to be part of a static page, where that item is not part of the dynamically altered code that was actually served, and such a false call can be detected and reported.
- As one example, a common method for making changes to a document object model (DOM) for a web page is the document.write method, and may be used by malicious code to surreptitiously change what the user of a computing device sees on a web page. A security system can (1) instrument served code corresponding to such a method so that the instrumentation code reports calls to the method, and additional includes data that characterizes such calls, so that the system can detect abnormal activity and perhaps use the additional data to determine whether the abnormal activity is malicious or benign; and (2) change the function name to “document.#3@1*87%5.write,” “1@2234$56%.4$4$345%4.@12111@”, or some other legal name that includes random text that can be changed automatically each time the code is served. Such constant changing creates a real challenge for a malicious party seeking to write code that can keep up with the changes, and also flags the presence of the malicious code when it attempts to interact with an outdated method name, and is reported by the instrumentation code. Other examples of JavaScript actions that can be instrumeand continually changed include “getElementById,” “getElementByName,” XPath commands, and setting of HTML elements in the DOM to particular values.
- The modification of code that is described in more detail below may be carried out by a security system that may supplement a web server system, and may intercept requests from client computers to the web server system and intercept responses from web servers of the system when they serve content back to the client computers (including where pieces of the content are served by different server systems). The modification may be of static code (e.g., HTML) and of related executable code (e.g., JavaScript) in combination. For example, the names of certain elements on a web page defined via HTML may be changed, as may references to items external to the HTML (e.g., CSS and JavaScript code). For example, the name of a label may be changed from a name provided by a programmer to an essentially random name like $4@376&8*. Such renaming may occur by first identifying programmatically related elements across the different types of code that are to be served to the client computer (e.g., HTML, CSS, and JavaScript) and grouping such occurrences of elements for further processing (e.g., by generating flags that point to each such element or copying a portion of each such element). Such processing may occur by modifying each element throughout the different formats of code, such as changing a name in the manner above each time that name occurs in a parameter, method call, DOM operation, or elsewhere. The modified elements may then be placed into the code to be delivered to the client computer, by recoding the code that was sent from the web server system, and serving the recoded code. Such a process may be repeated each time a client computer requests code, and the modifications may be different for each serving of the same code.
- Such modification of the served code can help to prevent bots or other malicious code operating on client computers from exploiting perceived weaknesses in the web server system. For example, the names of functions or variables may be changed in various random manners each time a server system serves the code. As noted above, such constantly changing modifications may interfere with the ability of malicious parties to identify how the server system operates and web pages are structured, so that the malicious party cannot generate code to automatically exploit that structure in dishonest manners. In referring to random modification, this document refers to changes between different sessions or page loads that prevent someone at an end terminal or controlling an end terminal to identify a pattern in the server-generated activity. For example, a reversible function may change the names when serving the code, and may interpret any HTTP requests received back from a client by changing the names in an opposite direction (so that the responses can be interpreted properly by the web servers even though the responses are submitted by the clients with labels that are different than those that the web servers originally used in the code). Such techniques may create a moving target that can prevent malicious organizations from reverse-engineering the operation of a web site so as to build automated bots that can interact with the web site, and potentially carry out Man-in-the-Browser and other Man-in-the-Middle operations and attacks.
- The ability to modify code that is served and to, in effect, reverse modify requests that are received back from a client device, can be made easier and more flexible by implementing the security server system as a stateless system, i.e., one that does not have to keep track of sessions with various client device in between communications with those devices. One such way to implement a statement system is to have the client device keep track of state-related information during such interstitial periods. As described in more detail below, for example, an initialization vector and cipertext that represents a code used to transform the outgoing content may be provided as a session cookie to the client device when the content is provided. The client device may then submit that cookie information when it makes a subsequent request. That request may include transformed information that the web server system would not understand, so the security system needs to perform a reverse transformation on it. The system may thus use the vector and ciphertext (along with its own private key) without having to store and keep track of it in order to perform the reverse transformation before giving the request to the web server system.
- As for identifying (rather than preventing) malicious activity, the code that is served to requesting clients, in addition to or as an alternative to being randomly modified so as to prevent automated malicious interactions at network endpoints, may be supplemented with instrumentation code that is programmed to identify alien content in the rendered web page on the client. That instrumentation code that runs on the client may, for example, be programmed to identify a function call for a function name that does not match function calls that are permissible for a particular served web page (e.g., where the alien call may be one that matches a name from the page originally provided by a web server but does not match the revised name generated by the code alteration techniques discussed in the prior paragraph). Such alien content may simply be an indication that the user has installed a legitimate plug-in to his or her browser, or it may also be an indication that the user's computer has become infected with malicious code (e.g., JavaScript code). Additional techniques may be used once alien content is identified so as to determine whether the content is malicious or benign.
- The techniques discussed here may be carried out by a server subsystem that acts as an adjunct to a web server system that is commonly employed by a provider of web content. For example, as discussed in more detail below, an internet retailer may have an existing system by which it presents a web storefront at a web site (e.g., www.examplestore.com), interacts with customers to show them information about items available for purchase through the storefront, and processes order and payment information through that same storefront. The techniques discussed here may be carried out by the retailer adding a separate server subsystem (either physical or virtualized) that stands between the prior system and the internet. The new subsystem may act to receive web code from the web servers (or from a traffic management system that receives the code from the web servers), may translate that code in random manners before serving it to clients, may receive responses from clients and translate them in the opposite direction, and then provide that information to the web servers using the original names and other data. In addition, such a system may provide the retailer or a third party with whom the retailer contracts (e.g., a web security company that monitors data from many different clients and helps them identify suspect or malicious activity) with information that identifies suspicious transactions. For example, the security subsystem may keep a log of abnormal interactions, may refer particular interactions to a human administrator for later analysis or for real-time intervention, may cause a financial system to act as if a transaction occurred (so as to fool code operating on a client computer) but to stop such a transaction, or any number of other techniques that may be used to deal with attempted fraudulent transactions.
- In certain implementations, the operation of a stateless security server system may provide one or more advantages. For example, certain implementations may eliminate a need to store and manage initialization vectors and other information needed to reverse-transform requests, which may be particularly relevant where many sessions are occurring at one time, and many of them never have a return request, such that the credentials would need to be saved for a time and constantly cleaned up by a system if a stateless approach were not used. Also, a stateless approach like those discussed here may eliminate the need to selectively direct return traffic to a particular security server sub-system. In particular, because the data needed for reverse transformations comes with the request, the request can be handled by any system that is executing the same transformation function as the original sub-system (as long as they all have access to the private key where such is needed in a particular implementation). Moreover, such an approach may permit for automatic correlation of state with externally linked CSS and JavaScript files.
- In one implementation, a computer-implemented method is disclosed for coordinating content transformation. The method comprises receiving, at a computer server subsystem and from a web server system, computer code to be served in response to a request from a computing client over the internet; modifying the computer code to obscure operation of the web server system that could be determined from the computer code; generating transformation information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system; and serving to the computing client the modified code and the reverse transformation information. At least some of the reverse transformation information can be encrypted so that code on the client computer cannot access the reverse transformation information. Also, the reverse transformation information can comprise a nonce and ciphertext. The method may also comprise receiving a subsequent request and the transformation information from the computing client, and using the transformation information to apply a reverse transformation to a portion of the request. Moreover, the method can include applying a private key held by the computer server system to the transformation information.
- In another implementation, a computer system for coordinating content transformation is disclosed. The system can include a web server that is configured to provide a resource in the form of computer code to client computing devices in response to requests from the client computing devices; and a security intermediary that is configured to (i) receive the resource from the web server before the resource is provided to the first client computing device, (ii) process the received resource, and (iii) transmit the processed resource and reverse transformation information to the first client computing device, wherein the reverse transformation information comprises information that is needed in order to reverse the modifications of the computer code to obscure the operation of the web server system. The system can include a computer interface configured to receive resources from a web server that has been served in the form of computer code to client computing devices in response to requests from the client computing devices.
- Other features and advantages will be apparent from the description and drawings, and from the claims.
-
FIG. 1A depicts a schematic diagram of an example system for serving web code and monitoring actions of client computers. -
FIG. 1B depicts a system-flow diagram of the example system and example operations of the system for serving web code and monitoring actions of client computers. -
FIG. 2 is a schematic diagram of a system for performing deflection and detection of malicious activity with respect to a web server system. -
FIG. 3 is a flow chart of a process for managing a state indicator. -
FIG. 4 shows schematically an encryption process. -
FIG. 5 is a schematic diagram of a computer system. - Like reference numbers and designations in the various drawings indicate like elements.
-
FIG. 1A is a schematic diagram of asystem 100 for serving web code and monitoring actions of client computers to identify abnormal behavior and potentially malicious activity. Web code may include, for example, HTML, CSS, JavaScript, and other program code associated with the content or transmission of web resources such as a web page that may be presented at aclient computing device 114. Thesystem 100 can detect and obstruct attempts by fraudsters and computer hackers to learn the structure of a website and exploit security vulnerabilities in theclient device 114. For example,malware 118 may infect aclient device 114 and gather sensitive information about a user of the device, discreetly modify an online transaction, or deceive a user into engaging in compromising activity such as divulging confidential information. Man-in-the-middle exploits are performed by one type ofmalware 118 that is difficult to detect on aclient device 114, but can use security vulnerabilities at the client to engage in such malicious activity. - The
system 100 can serve modified and instrumented web code to theclient device 114 to detect and obstructmalware 118 attempts to discern and exploit operations of aweb server 104. In this example, the modifiedweb code 114A is represented as a portion of a document on theclient device 114, while the instrumentation code 1148 is represented as another portion of theclient device 114. Such simplified representation is provided for sake of explanation, though actual delivery and execution of the code may take a variety of forms, including by a web browser on theclient device 114 rendering a page and potentially accessing additional code (e.g., JavaScript or code from other domains) based on code that is part of the web page, and the browser may build a document object model in a familiar manner by such rendering and execution of the provided code. - The
system 100 can include asecurity intermediary 102 that is logically located between theweb server 104 and one ormore client devices 114. Thesecurity intermediary 102 can receive a portion or all of the traffic, including web code, transmitted betweenclient devices 114 and the web server 104 (and vice-versa). In compliance with a governing security policy, when theweb server 104 provides a resource such as a web page in response to aclient device 114 request, theweb server 104 can forward the response to the security intermediary 102 (perhaps through a load balancer or other data management devices or applications) so that the web code for the response can be modified and also supplemented withinstrumentation code 114B. Modification of the web code may be random in certain manners, and can differ each time a response is served to a client to preventmalware 118 from learning the structure or operation of theweb server 104, or from being developed by a malicious organization that learns the structure or operation. Additionally, the web code can be supplemented with instrumentation code that is executable on theclient device 114. Theinstrumentation code 114B may detect when abnormal behavior occurs on theclient device 114, such as possible unauthorized activity by themalware 118, and can report the occurrence of such activity to thesecurity intermediary 102. - When
security intermediary 102 receives requests (e.g., HTTP requests) from clients in response to modified web code being processed on those clients, it can apply reverse modifications to the requests before forwarding the requests to theweb server 104. Additionally, thesecurity intermediary 102 can receive reports from the instrumentation code that indicate abnormal behavior on theclient device 114, and the intermediary can log these events, alert theweb server 104 to possible malicious activity, and send reports about such events to a central security server (not shown). The central security server may, in some implementations, analyze reports in the aggregate frommultiple security intermediaries 102, and/or reports frommultiple client devices 114 and multiple computing sessions and page loads. - The
security intermediary 102 can additionally create a code that defines the transformation that was performed on the web code. For example, a particular function may be applied to strings in the code to generate random text, and that function can be seeded with a code that affects the result of the function—e.g., where application of the same seed and the same text will always produce the same “random” output, but a different seed is used for each request or session so that the served text is seen as random. The served text may also be accompanied with information that may be stored as acookie 115 on theclient device 114. When the client device makes subsequent requests to theweb server 104, code on the client device may cause the cookie information to be passed with the request. Such cookie information may include, for example, an initialization vector (as a large random number) for the transformation function and cipertext (e.g., in Base64). The cookie may be treated by thesystem 100 as a session cookie in this example. - One format for such a cookie may be as follows:
-
Set-Cookie: Nonce=wk04328jsajsdfioj3f Set-Cookie: Ciphertext=QmFzZTY0IGVuY29kaW5nIHNjaGVtZXMgYXJlIGNvbW1vbmx5IHVz ZWQgd2hlbiB0aGVy ZSBpcyBhIG5lZWQgdG8gZW5jb2RlIGJpbmFyeSBkYXRhIHRoYXQgbmVlZHMg YmUgc3RvcmVkIGFuZCB0cmFuc2ZlcnJlZCBvdmVyIG1lZGlhIHRoYXQgYXJlIG Rlc2lnbmVkIHRvIGRlYWwgd2l0aCB0ZXh0dWFsIGRhdGEuIFRoaXMgaXMgdG -
FIG. 1B is a schematic diagram of thesystem 100 depicted inFIG. 1A , including a process for serving code and monitoring actions of client computers to identify anomalous and potentially malicious activity. Thesystem 100 may include aweb server 104,security intermediary 102,security server 108, and one ormore client devices Client device 114 has been infected withmalware 118 that may attempt to exploit security vulnerabilities at theclient device 114 and/or theweb server 104, whileclient device 112 is “clean” or uninfected in this example. For example, themalware 118 may have been written by an organized crime syndicate to identify transactions with a particular bank whose web site structure the syndicate has studied, and may attempt to induce users to provide private information such as PIN codes by recognizing when the bank's web page is loaded by a browser, and interfering with the normal user interface of the bank's web page, such as by generating a pop-up seeking the user's PIN number, in a manner that it looks to the user like the bank generated the pop-up. In an actual implementation, thesystem 100 would communicate with thousands, tens of thousands, hundreds of thousands, or millions of client devices—some compromised and some clean—over a long time period, though the number here is reduced for the sake of simplification. - The web server 104 (which in normal implementation would be implemented in a large number of physical or virtual servers across one or more data centers, such as in one or more racks of servers) may host electronic resources and provide services over one or more networks such as the
internet 110. For example, theweb server 104 may serve code for pages of one or more websites by storing resources for each website such as HTML pages, scripts, images, media, and user data at theserver 104, and providing the resources upon request. For instance, theweb server 104 may receive an HTTP request from aclient device 112 that requests theserver 104 to provide theclient device 112 with a code for generating a webpage. In response, theserver 104 retrieves one or more resources associated with the request and transmits them to the requestingclient device 112. Theserver 104 may respond to an HTTP request by serving an HTML file that represents a webpage. The HTML file may reference other resources such as advertisements, images, JavaScript code, or Cascading Style Sheets (“CSS”) that theclient device 112 can use to load and present the webpage to a user. Theweb server 104 may provide the referenced files to satisfy the initial request, or may provide the files in response to subsequent requests from theclient device 112. - The
web server 104 can be implemented with various combinations of software and hardware. In some implementations, theweb server 104 can support services other than or in addition to HTTP, including FTP, SSH, TelNet, and/or IMAP, POP, and SMTP for e-mail services. Theweb server 104 may also support secure connections such as through SSL and HTTPs protocols. Various open-source or commercial software products may be used in implementing theweb server 104, such as APACHE web server software or Windows Home Server software. Also, theweb server 104 can be comprised of one or more computing devices, such as a distributed server system with multiple connected devices that each provide portions of the operations (e.g., as a server bank, a group of blade servers, or a multi-processor system). - The
client computing devices web server 104 over a network such as theinternet 110. Theclient devices internet 110. Theclient devices client devices web server 104. -
Malware 118 may be present on one or more client devices that communicate with theweb server 104. InFIGS. 1A and 1B ,malware 118 has infected theclient device 114, but notclient device 112.Malware 118 can include any software that exploits operations of a client or remote computing system such as theweb server 104.Malware 118 may engage in various malicious behaviors, including attempts to gather private, digitally-stored information about users such as identification or financial information. Attackers can also usemalware 118 to access secure computer systems without authorization, destroy digital information, or gain control of a computer system from an authorized user.Malware 118 may include viruses, Trojan horses, spyware, adware, and other malicious software. Attackers have developed sophisticated methods to deploymalware 118 onclient computing devices 118 without a user's knowledge. For example, using phishing and other social engineering techniques, attackers may deceive users into accessing a resource that installsmalware 118 on the user's computing system without notice or detection. - Some
malware 118 can exploit security vulnerabilities in the client device 114 (including in a browser or browsers executing on the client device 114) to obtain sensitive user account information and to initiate fraudulent transactions. Attackers may use man-in-the-middle attacks, for instance, to intercept communications between theclient device 114 and theweb server 104. Even where a secure communication protocol is used between theclient device 114 and theweb server 104, somemalware 118 can intercept communications (e.g., after they have been decoded on the client device 114), log information about the communications, and even alter such communications. In man-in-the-browser attacks, themalware 118 may compromise a web browser atclient device 114 such that themalware 118 activates when a user visits a particular website. Themalware 118 may access information about the website even after code for the site is decrypted, and in some instances, themalware 118 may inject extra code such as HTML or JavaScript to create malicious forms that prompt users to divulge confidential information that can later be transmitted to attackers for further use. Man-in-the-browser malware 118 may also alter an HTTP request from theclient device 114 without the user's knowledge to divert a request to an unauthorized server or to implement a fraudulent transaction. For example, in a banking transaction,malware 118 in theclient computing device 114 may alter the destination account number in a wire transfer to deliver funds to a mule account rather than an account specified by the user. Somemalware 118 may passively reside in theclient device 114 to monitor features of a site so that manual or automated attacks on the site'sweb server 104 can be made at a later time. -
Security intermediary 102 may include one or more computing devices (e.g., physical or virtual server instances) that are situated between theclient computing devices web server 104. Thesecurity intermediary 102 receives and processes at least a portion of traffic transmitted between theweb server 104 and other computing devices that interact with theweb server 104, such as theclient devices security intermediary 102 may be a physical or virtual subsystem of theweb server 104. Thesecurity intermediary 102 may be configured to modify and/or analyze web code transmitted to and from theweb server 104 to detect alien (i.e., abnormal) or malicious transactions and to obscure operations of theweb server 104 by various forms of malware. - The
security intermediary 102 is forwarded or intercepts traffic transmitted from theweb server 104 before the traffic is received by a requesting computer device such asclient devices security intermediary 102 may receive content from theweb server 104 through a direct connection with theweb server 104 or through a local area network (“LAN”) before transmitting the content over theinternet 110. Conversely, thesecurity intermediary 102 may also receive incoming traffic that is destined for theweb server 104 so that it can process the traffic before it is received by theweb server 104. In some implementations, thesecurity intermediary 102 may be configured as a reverse proxy server that appears to clients to host and serve a website or other electronic resources as if it were theweb server 104. In certain implementations, different subserver systems can be used for outgoing service of code and incoming processing of requests, with the subsystems communicating so that one system can provide reverse translations to the translations originally provided by the first subsystem. Such coordination may occur, whether a single security subsystem is used or multiple subsystems are used, such as by storing a cookie or similar identifier onclient devices - The
security intermediary 102 may include one or more computing devices that are separate from computing devices of theweb server 104. In such implementations, thesecurity intermediary 102 may communicate directly with the web server through a networking cable such as an Ethernet cable or fiber optic line (and typically through many such connections). The intermediary 102 can also communicate with theweb server 104 through a network such as a local area network (“LAN”). In some instances, the intermediary 102 can be installed on the same premises as theweb server 104 so that operators or administrators of theweb server 104 can also maintain the intermediary 102 locally (particularly for large-volume applications). Installing the intermediary 102 in close proximity to theweb server 104 can have one or more additional benefits including reduced transmission latency between the intermediary 102 and theweb server 104 and increased security that stems from a private connection between the intermediary 102 and theweb server 104 that is isolated from public networks such as theinternet 110. This configuration can also avoid any need to encrypt communication between the intermediary 102 and theweb server 104, which can be computationally expensive and slow. - In some implementations, the
security intermediary 102 may include one or more computing devices that are separate from the computing devices of theweb server 104, and that are connected to theweb server 104 through a public network such as theinternet 110. For example, a third-party security company may maintain one ormore security intermediaries 102 on the security company's premises. The security company may offer services to protect websites and/orweb servers 104 from exploitation according to the techniques described herein. Thesecurity intermediary 102 could then act as a reverse proxy for theweb server 104, receiving outbound traffic from theweb server 104 over theinternet 110, processing the traffic, and forwarding the processed traffic to one or more requestingclient devices client devices internet 110, process the incoming traffic, and forward the processed traffic to theweb server 104 over theinternet 110. In this configuration, communication between thesecurity intermediary 102 and theweb server 104 may be encrypted and secured using protocols such as HTTPS to authenticate the communication and protect against interception or unauthorized listeners over theinternet 110. In some embodiments, a private line or network may connect theweb server 104 to theremote security intermediary 102, in which case thesystem 100 may use unencrypted protocols to communicate between the intermediary 102 andweb server 104. - In some implementations,
security intermediary 102 may be a virtual subsystem ofweb server 104. For example, the one or more computing devices that implementweb server 104 may also include software and/or firmware for thesecurity intermediary 102. Thesystem 100 may include thesecurity intermediary 102 as software that interfaces with, and/or is integrated with, software for theweb server 104. For example, when theweb server 104 receives a request over theinternet 110, the software for thesecurity intermediary 102 can first process the request and then submit the processed request to theweb server 104 through an API for theweb server 104 software. Similarly, when theweb server 104 responds to a request, the response can be submitted to thesecurity intermediary 102 software through an API for processing bysecurity intermediary 102 before the response is transmitted over theinternet 110. - In some configurations of the
system 100, two ormore security intermediaries 102 may serve theweb server 104.Redundant security intermediaries 102 can be used to reduce the load on anyindividual intermediary 102 and to protect against failures in one or more security intermediaries. Thesystem 100 can also balance traffic among two ormore security intermediaries 102. For example, thesystem 100 may categorize traffic into shards that represent a logical portion of traffic to or from a website. Shards may be categorized according to client identity, network information, URL, the domain or host name in an HTTP request, identity of resources requested from theweb server 104, location of resources requested from theweb server 104, and/or the content of a request or the requestedresource 104. - The
security intermediary 102 can process traffic transmitted to and from theweb server 104. Processing traffic may include analyzing web code to identify alien or malicious activity, reversibly modifying web code to obscure elements of resources provided by theweb server 104, and/or inserting instrumentation code into web code provided by theweb server 104 to facilitate detection of alien or malicious activity at theclient computing device security intermediary 102 can also apply reverse modifications on requests or other information transmitted byclient devices web server 104. This document sometimes refers to reverse modifications as inverse modifications and these terms are intended to have the same meanings unless indicated otherwise. - The
security intermediary 102 can make various modifications to outgoing web code. In one example, thesecurity intermediary 102 can make random or pseudo-random changes (both of which are covered by the term “random” in this document unless indicated otherwise) in HTML attribute values in links or forms, which theclient web server 104. For instance, aweb server 104 for an online retailer at www.examplestore.com can provide a text field in a checkout page for a user at theclient device web server 104 may include an HTML tag to create the field: <input type=“text” name=shippingaddress>. To obstruct attempts bymalware 118 that may have compromised theclient device 114 to exploit the field and engage in a fraudulent transaction, thesecurity intermediary 102 can replace one or more attributes for the field, such as by generating a pseudo-random value for the ‘name’ attribute to replace ‘shippingaddress.’ Thesecurity intermediary 102 may then forward the modified HTML for the webpage to theclient device 114. Theclient device 114 may then generate HTTP requests for theweb server 104 that include the modified attribute, such as in a POST request that references the pseudo-random ‘name’ attribute value. When thesecurity intermediary 102 receives theclient device 114 POST request, it applies a reverse modification to the attribute value, replacing the pseudo-random value with the original ‘shippingaddress’ value, and then forwards the request toweb server 104. Thesecurity intermediary 102 may store or access translation tables to apply the reverse modifications, or use encrypted content in information associated with the request to apply reverse modifications. Further explanation and examples of security intermediary 102 operations, including techniques for detection and deflection of unauthorized activity, are discussed in further detail with respect toFIGS. 2-4 . - The
security intermediary 102 can apply different modifications to web code each time the code is served to one ormore client devices client malware 118 in the client to study and/or exploit the structure of a website or other web application. Each time theweb server 104 provides a particular resource, such as a web page, thesecurity intermediary 102 can apply different and unique modifications to the page. Modifications may vary across different users,different clients client device 112 may receive a particular page with one set of modifications during a first session, and different, second set of modifications during a different session. Similarly, for two different users atclient devices web server 104, thesecurity intermediary 102 may apply different modifications to each resource, even if the users made their requests at substantially the same time. By modifying content differently each time it is served, thesecurity intermediary 102 creates a moving target that obstructs attempts bymalware 118 to determine a “normal” structure of the site or to identify patterns in the structure of a site. Performing such random modifications makes it more difficult formalware 118 to successfully initiate a fraudulent transaction with theweb server 104 or otherwise engage in unauthorized activity. - The modification may be applied according to an initialization vector in the form of a large random number that is generated for each user session with a particular web site. Where the
security intermediary 102 is implemented as a stateless embodiment, the security intermediary may send the modified content along with information for a cookie, where the information allows for the reverse modification of any requests from the client device (e.g., where the requests might include text that has been modified and thus would not be recognizable to the web server). Upon receiving such a follow-up request, the security intermediary may parse the transformation information from the request (e.g., to obtain a nonce and ciphertext) and may uses that information to unmodify any modified text in the request. - The
system 100 may include aload balancer 106, which can function as a reverse proxy and distribute incoming traffic fromclient devices more web servers 104 and/or one ormore security intermediaries 102. Theload balancer 106 can be connected to a network such as theinternet 110, one ormore web servers 104, and one ormore security intermediaries 102. Theload balancer 106 analyzes incoming traffic (e.g., traffic destined for the web server 104) and may categorize the traffic into shards. Traffic may be distributed, for example, based on a Layer 4 transport or network layer analysis, or based on a Layer 7 application layer analysis. For example, FTP requests may be channeled to aweb server 104 configured to process FTP requests, whereas HTTP requests may be channeled to aweb server 104 configured to process HTTP requests. Similarly, in Layer 7 analysis, theload balancer 106 may distribute incoming traffic based on the content of an HTTP header or content of the application message itself. For instance, at an online banking website for www.examplebank.com, certain pages on the site may be unrelated to a customer's online banking experience, such as privacy and terms of use pages for the site. At these pages, the customer does not interact with his bank account, and the customer can only consume or request information from the page, but he cannot post information to theweb server 104 from that page. These pages may be deemed a low security risk and theload balancer 106 can be configured to identify low risk pages from HTTP requests in incoming traffic. Theload balancer 106 may forward low risk traffic directly to theweb server 104 and bypass thesecurity intermediary 102. - The
load balancer 106 can also distribute traffic amongmultiple security intermediaries 102. In one example, incoming traffic can be distributed so that eachsecurity intermediary 102 maintains a substantially equal load as theother intermediaries 102 or receives a substantially equal amount of traffic as theother intermediaries 102. In some instances, incoming traffic may be responsive to previously transmitted web code that had been processed and modified by aparticular security intermediary 102. Theload balancer 106 may distribute such incoming traffic to theparticular security intermediary 102 that generated the previously modified code so that theparticular security intermediary 102 can apply a reverse modification to web code in the incoming traffic based on a transformation table that may be stored locally on theparticular security intermediary 102. In some implementations, however, transformation tables may be shared or accessible by one or moreother security intermediaries 102, or modifications may be stateless, so that web code from incoming traffic can be distributed to any intermediary 102. - Once incoming traffic has been distributed to and processed by a
security intermediary 102, theload balancer 106 may receive the processed traffic from thesecurity intermediary 102 and forward the traffic to theweb server 104. - The
load balancer 106 can also distribute outgoing traffic from theweb server 104 for processing by asecurity intermediary 102 before transmitting the traffic to theclient device load balancer 106 may categorize outgoing traffic into shards based on information in the network, transport, or application layers of the traffic. Theload balancer 106 may determine that some traffic shards may bypass thesecurity intermediary 102 and may transported over theinternet 110 for transmission to aclient device more security intermediaries 102 for processing. In implementations of thesystem 100 that includemultiple security intermediaries 102, theload balancer 106 may distribute outgoing traffic to maintain generally equivalent loads among themultiple intermediaries 102. Thesecurity intermediaries 102 can then transmit processed traffic back to theload balancer 106 for delivery toclient devices internet 110. - A configuration module 120 can be used to monitor the
system 100 and to configure various aspects of the system's 100 operation. An administrator can use the configuration module 120 to provide system updates, change and load one or more system policies, manage users, select an operation mode, define how to handle exceptions, and/or monitor the health and status of thesystem 100. - In one implementation, an administrator may use the configuration module 120 to update system software to improve the performance and security of the system. As the
system 100 is deployed for periods of time in the field,malware 118 designers may attempt to learn about thesystem 100 and exploit any detected security vulnerabilities. To prevent this, thesystem 100, including, for example, thesecurity intermediary 102, can be updated with new software that patches security vulnerabilities and improves system performance. New features may also be introduced such as new algorithms for modifying web code or implementing instrumentation code. - The administrator can also use the configuration module 120 to select or change different system policies. For example, particular modification modes may be selected. The administrator can choose whether the
security intermediaries 102 should apply modification techniques that involve only modifying a web application's implicit API (e.g., form fields, links, AJAX calls), for example, or if instrumentation code or other content should be supplemented with the web code. The administrator can also configure how sessions are managed. For example, thesecurity intermediary 102 can be configured to apply a unique session ID each time aclient device - The configuration module 120 can also facilitate management of resource families, which are categories of requests and electronic content for which a particular security policy applies. Thus, the
system 100 may allow one or more resource families to bypass operations of thesecurity intermediary 102, while resources in other families must pass through thesecurity intermediary 102 for modification or analysis before being delivered to aclient device web server 104. If a web serve 104 serves multiple sites or multiple domains, different policies may apply among the different sites and/or domains. An administrator can create, modify and remove resource policies at the configuration module 120, and can indicate which security policy or policies to apply to various families. - An administrator 120 can also configure how the
system 100 should apply various security policies based on factors other than or in addition to resource families. For instance, different policies may apply based on characteristics of the device that is making the request or the network on which the requesting device is on. Thesecurity intermediary 102 may determine identities ofclient devices system 100 to apply more restrictive security policies to particular requestingclient devices - At the direction of an administrator or other user with appropriate system privileges, the configuration module 120 can change operating modes in the
security intermediary 102 and/or adjust the security policy of one or more resource families, clients, or networks. Thesecurity intermediary 102 may be capable of various modification modes that the administrator can apply to a resource family, for example. In some modes, very subtle modifications may be made to elements of the web code in order to detect anomalous or malicious activity, whereas other modes may apply increasingly more complex or widespread modifications that are aimed at preventing unauthorized activity. In some implementations, policy settings or mode changes can be triggered automatically by the configuration module 120. - The configuration module 120 can also allow an administrator to specify how the
security intermediary 102 should respond to exceptions. Exceptions can relate to internal system errors or to detection of fraud, malware, abnormal behavior, and/or malicious activity in traffic received from aclient device security server 108 for further analysis or storage. For instances of detected fraud, malware, or alien or malicious web code, thesecurity intermediary 102 can be configured to respond in one or more ways. The intermediary 102 may log the event and transmit it tosecurity server 108 for further analysis. In some implementations, thesecurity intermediary 102 may alert theweb server 104 of suspected unauthorized activity, so that theweb server 104 can respond in a particular way. For example, in a banking transaction involving suspected fraud, thesystem 100 can be configured to process the transaction normally, log the transaction, and alert various parties or authorities. Alternatively, the transaction can be thwarted if thesecurity intermediary 102 is configured to alert theweb server 104. Theweb server 104 can respond to a fraud alert by generating a web resource for delivery to an infected orfraudulent client device 114 that indicates the transaction was processed as requested, when in fact it was not. - The administrator may also manage users at the configuration module. For example, various user categories may provide system users with varying levels of use and access privileges to the
system 100. In one implementation, thesystem 100 may provide four user categories: super-users, system operators, analysts, and auditors. Super-users can create other users and are able to access and perform any action provided for by thesystem 100. The administrator may be a super-user, for instance. System operators can configure thesystem 100 and view data from thesystem 100, but cannot manage other users. Analysts can view data from thesystem 100, but they cannot modify the system's configuration. Finally, an auditor can view a limited set of system data such as how the system was used and by whom. - The configuration module 120 can also provide a portal for various other system settings such as those that may be required for installation and setup of the
security intermediary 102, or to configure a particular system setup, such as registration with asecurity server 108, interoperability with theload balancer 106, and arrangements ofmultiple security intermediaries 102. The configuration module 120 can be accessible at a terminal on the premises of thesecurity intermediary 102 and can be separate from or integrated with thesecurity intermediary 102. In some implementations, the configuration module 120 can be accessible remotely, such as through an interface at a desktop or mobile computing device that can communicate with thesecurity intermediary 102 through a network. - The
security server 108 can receive and analyze security event information from thesecurity intermediary 102. Security event information can include logs and alerts generated by thesecurity intermediary 102 that indicate when the intermediary 102 detects anomalous or malicious activity. Feedback from instrumentation code that thesecurity intermediary 102 supplements with the web code for particular web resources may indicate such anomalous or malicious activity. Likewise, a request from aninfected client device 114 that calls an unauthorized function that does not match modifications for a given session may generate an alert by thesecurity intermediary 102. - Information about security events can be forwarded to the
security server 108. In one example, thesecurity server 108 can be dedicated to events received from one ormore security intermediaries 102 that serve aparticular web server 104. In some implementations, thesecurity server 108 can be a centralized server that receives security event information from a plurality ofsecurity intermediaries 102 that servemultiple web servers 104 and/or websites. Information onsecurity events 108 from multiple sites can be analyzed in aggregate to study developing security threats, determine whether some anomalous activity may nevertheless be benign (such as traces from an authorized or legitimate browser plug-in), to publish statistics or report information on security events to interested parties, and/or to use in developing updates and improvements to thesystem 100 for increased performance and security. Thesecurity server 108 can analyze information from across multiple computing sessions and/or multiple clients as well. - The
security server 108 can also receive operating information from thesecurity intermediary 102 that can be used to monitor system performance. For instance, thesecurity intermediary 102 may track and report information about the speed and volume of modifications that it makes to web code, or information about its usual and peak operating levels. The information can be used to make or recommend system configurations to optimize performance and to compare information frommultiple security intermediaries 102 deployed acrossmultiple web servers 104. - Communication between the
security intermediary 102 and theclient devices internet 110. In some implementations, eachclient computing device security intermediary 102 through theinternet 110. In some implementations, thesystem 100 may be installed on a private network rather than, or in addition to, theinternet 110. Communications over theinternet 110 can be encrypted and verified such as with HTTPS and Secure Sockets Layer (“SSL”) protocols. - Describing now one particular example of the operations of the
system 100 with reference toFIG. 1B , at step A, theweb server 104 responds to a request fromclient devices web server 104 accesses or generates the resource, which in the example is awebpage 116A relating to a financial transaction. For instance, theweb server 104 may serve an online banking site, www.examplebank.com. Thewebpage 116A may provide forms for account holders at theclient devices webpage 116A may implement the form with HTML tags such as <form> and <input> tags that are each identified by a name. For instance, the destination account field is named “money_dest.” Theclient devices web server 104 through a GET or POST HTTP request method, for example. - Before the
system 100 transmits thewebpage 116A over theinternet 110 and to each of theclient devices page 116A is directed to thesecurity intermediary 102. Theload balancer 106 may determine whichsecurity intermediary 102 to direct thewebpage 116A to in implementations where there may be multiple,redundant security intermediaries 102. A policy engine at thesecurity intermediary 102 may determine how thesecurity intermediary 102 will process thewebpage 116A. For example, the policy engine may determine that thewebpage 116A, which pertains to sensitive financial transactions, is part of a resource family that the intermediary 102 has been configured to modify and to insert instrumentation code. Other resources from the banking site, such as its homepage, may contain less sensitive information and may be subject to lower-level security policies such that thesecurity intermediary 102 may handle the homepage with less sensitivity than thewire transfer webpage 116A. - At steps B1 and B2, the
security intermediary 102 processes thewebpage 116A according to the governing security policy and transmits processedwebpage 116B toclient devices security intermediary 102 may modify elements of the webpage's 116A implicit API, such as field names, function names, and link references. In the example operations of thesystem 100, thesecurity intermediary 102 changes the name of the destination account field inwebpage 116A from “money_dest” to “x1$v4.” The name change obscures the identity of the field to preventmalware 118 from learning how to exploit the field. Moreover, thesecurity intermediary 102 can apply different pseudo-random modifications each time thewebpage 116A is served to prevent themalware 118 from tracking patterns that themalware 118 could use to exploit theweb server 104 or initiate a fraudulent transaction, for example. Other techniques for obscuring content, including obscuring the environment in which web code such as JavaScript operates, are discussed further herein. - Second, the
security intermediary 102 can insert instrumentation code into the webpage that can detect certain activity that may indicate alien content (e.g.,malware 118 or legitimate code on aclient device security intermediary 102 and/or acentral security server 108. - Instrumentation code may also collect information about particular activity that occurs on the
client device 112 and/or 114. For instance, the instrumentation code may collect information about how a user interacts with the web page such as key strokes, mouse movements, changes in focus between particular forms, fields, or frames, and patterns and timing of interactions with the page. Information about the user's operating environment may also be collected, such as network configurations, operating system information, hardware specifications, performance indicators, session identifiers, other cookies, browser type, browser settings, IP address, MAC address, client device type, plug-ins, screen resolution, installed fonts, timestamp, site or page identifier, GPS data, etc. In some implementations, users and system operators can configure the instrumentation code to restrict or anonymize the data that it gathers to respect user privacy. - The
security intermediary 102 can also include an identifier, such as a session identifier in a cookie, with the processedweb page 116B. Thesecurity intermediary 102 can store the identifier in a data structure, table, or database that correlates the original web code with the modified web code for a particular resource so that thesecurity intermediary 102 can apply reverse modifications to requests based on modified resources before forwarding the request to theweb server 104. For example, thesecurity intermediary 102 may assign a unique identifier to thewebpage 116A, and store the identifier in a table that associates the resource's original field name, “money_dest,” with the modified field name “x1$v4.” Later transactions posted to theweb server 104 from the modifiedpage 116B can be received by thesecurity intermediary 102 for reverse modification before forwarding the request to theweb server 104. Thesecurity intermediary 102 can determine which reverse modifications to apply based on the identifier. In some implementations, the identifier can be a session identifier. - At step C1,
client device 112 has received the modified (i.e., processed) web code ofweb page 116B.Client device 112 is a clean device in that nomalware 118 that is configured to attack the online banking website has infected thedevice 112. A user at theclient device 112 provides into the fields on theweb page 116B the necessary information to complete a wire transfer, such as an indication of the source account, destination account, and transfer amount. The user may then submit the request for a wire transfer, which a browser on theclient device 112 converts into an HTTP request to theweb server 104 that includes the information submitted by the user with corresponding field names. The HTTP request fromclient device 112 uses the random field name that thesecurity intermediary 102 generated for the destination account field, “x1$v4.” - Instrumentation code 1128 can monitor the
webpage 116B onclient device 112. In some implementations, the instrumentation code 1128 may determine thatmalware 118 or other anomalous activity has altered thewebpage 116B and may be attempting to initiate an unauthorized transaction. For example, the instrumentation code 1128 may include information about the modified web code forweb page 116B, and may be programmed to detect when elements of the modified code are altered at theclient device 112. For instance, the instrumentation code may determine whether the document object model (“DOM”) for the webpage has been altered, or if the HTTP request based on the webpage uses unexpected values that do not correspond to the modified web code delivered inweb page 116B. For instance, the instrumentation code may detect that theclient device 114 has called an original function value rather than its modified, replaced value. - Malicious activity can be both detected and deflected in relatively sophisticated manners by changing the environment in which executable code on the client device, such as JavaScript, operates. Detection can occur by identifying certain JavaScript operations or calls that may be made on a page, and instrumenting code that is served with a web page so as to report to a security server system when such operations occur and/or such calls are made (along with information that describes the actions). Deflection occurs by the constant changing of code elements as they are served each time, such as changing the names of elements that will be called by malicious JavaScript, so that the malicious code can never catch up with the changes and thus gives itself away when it tries to interoperate with code known by the system to be stale. As one example, a common method for making changes to a DOM for a web page is the document.write method, and may be used by malicious code to surreptitiously change what the user of a computing device sees on a web page. A security system can (1) instrument served code corresponding to such a method so that the instrumentation code reports calls to the method, and additionally includes data that characterizes such calls, so that the system can detect abnormal activity and perhaps use the additional data to determine whether the abnormal activity is malicious or benign; and (2) change the function name to “document.#3@1*87%5.write” or some other legal name that includes random text that can be changed automatically each time the code is served. Such constant changing creates a real challenge for a malicious party seeking to write code that can keep up with the changes, and also flags the presence of the malicious code when it attempts to interact with an outdated method name, and is reported by the instrumentation code. Other examples of JavaScript actions that can be instrumented and continually changed include “getElementById,” “getElementByName,” XPath commands, and setting of HTML elements in the DOM to particular values.
- As instrumented code executes on the
client device security server 108 and/or thesecurity intermediary 102. Thesecurity server 108 may receive instrumentation reports directly from theclient devices security intermediary 102. The instrumentation code may generate and transmit reports periodically or upon request, for instance. Reports can also be transmitted in subsequent HTTP requests from theclient device web server 104, and can be received by thesecurity intermediary 102. Alternatively or in addition to these techniques, instrumentation reports can be sent to thesecurity intermediary 102 orsecurity server 108 asynchronously, such as through the use of AJAX or WebSocket. - At step C1,
malware 118 has not interfered with the transaction, and the HTTP request includes the appropriate modified field names such as “x1$v4” for the “money_dest” field. Therefore, the instrumentation code 1128 does not report the presence of anomalous or malicious activity to thesecurity intermediary 102. - At step C2,
client device 114 is shown to have received the modified (i.e., processed) web code forweb page 116B. Unlikeclient device 112, however,client device 114 is compromised withmalware 118, such as a man-in-the-browser bot. When a user of the compromisedclient device 114 submits the wire-transfer transaction, themalware 118 may intervene and replace the destination account field name with “money_dest”—the original field name before thesecurity intermediary 102 modifiedweb page 116A. The bot may use the original field name, for example, based on previous analysis of the banking website in instances where thesecurity intermediary 102 did not modify the field name. Theinstrumentation code 114B can detect the behavior or consequences of the behavior ofmalware 118, and generate a report to alert thesecurity intermediary 102 and/or theweb server 104 of suspicious activity. Theinstrumentation code 114B inFIG. 1B , for example, reports the suspicious activity by causing the HTTP request that the user submits for the transaction to include the field name “x1$v4*” in place of the malware's 118 field name “money_dest.” The asterisk appended to the end of the modified field name indicates that theinstrumentation code 114B detected suspicious activity. - At steps D1 and D2, the
security intermediary 102 receives the HTTP requests for the wire-transfer transaction fromclient devices web server 104. The HTTP requests from theclient devices security intermediary 102 can use in decoding the HTTP requests. Thesecurity intermediary 102 can lookup the session identifier in a translation table, and decode the request by applying reverse modifications that restore the original field and function names, for example. With respect to the request that the intermediary 102 receives from theclean client device 112, the intermediary 102 receives the substitute field name “x1$v4” as expected, decodes the field name by replacing it with “money_dest” and forwards the request to theweb server 104 through theload balancer 106. The operation ofsecurity intermediary 102 is transparent to theweb server 104, and theweb server 104 can process the transaction according to the user's request. - With respect to the HTTP request from the compromised
client device 114, thesecurity intermediary 102 recognizes the instrumentation code's 114 report of suspicious activity, and sends an alert to theweb server 104. Thesecurity intermediary 102 can use the session identifier in the HTTP request to determine the appropriate reverse modifications necessary to decode the request. Thesecurity intermediary 102 may recognize that the field name “x1$v4*” corresponds to the original “money_dest” field name, but that theinstrumentation code 114B appended an asterisk to the field name to indicate possibly malicious activity. Thesecurity intermediary 102 can respond to the indication in various ways according to the applicable security policy and/or system configuration settings. In one example shown in step D2, the intermediary 102 forwards the decoded request to theweb server 104, but appends the asterisk to the destination account field name, “money_dest*,” to notify theweb server 104 that the transaction is suspicious, and may indicate the presence of unauthorized alien content. In response, theweb server 104 may ignore the alert, complete the transaction and log the alert, refuse to complete the transaction, pretend to complete the transaction, and/or take other appropriate action. In some implementations, thesecurity intermediary 102 may not forward the transaction request to theweb server 104 if suspicious activity has been detected. - At step E, the
security intermediary 102 may forward information about the transactions between the web server and theclient devices 112 and/or 114 to thesecurity server 108. For example, thesecurity intermediary 102 may share information about the transaction fromclient device 114 in which theinstrumentation code 114B reported suspicious activity. Theinstrumentation code 114B may include a report about the detected suspicious activity and its circumstances that thesecurity intermediary 102 can provide to thesecurity server 108. For example, the report may include information about theclient device 114, the abnormal or suspicious activity, the electronic resources and fields involved, and information about the browser, operating system, or other application that themalware 118 may have compromised. Data from thesecurity server 108 can be analyzed with respect to thesecurity intermediary 102 for a particular site, or in aggregate with information fromother security intermediaries 102 that serve other websites andweb servers 104. Thesecurity server 108 can analyze data across multiple computing sessions and for multiple client devices. The analysis from thesecurity server 108 can be used, for instance, to identify new threats, track known threats, and to distinguish legitimate abnormal or alien activity from malicious activity. -
FIG. 2 is a schematic diagram of asystem 200 for performing deflection and detection of malicious activity with respect to a web server system. The system may be the same as thesystem 100 discussed with respect toFIGS. 1A and 1B , and is shown in this example to better explain the interrelationship of various general features of theoverall system 200, including the use of instrumentation code for detection and deflection that is discussed in greater detail throughout this document. - The
system 200 in this example is a system that is operated by, or for, a large number of different businesses that serve web pages and other content over the internet, such as banks and retailers that have on-line presences (e.g., on-line stores, or on-line account management tools). The main server systems operated by those organizations or their agents are designated as web servers 204 a-204 n, and could include a broad array of web servers, content servers, database servers, financial servers, load balancers, and other necessary components (either as physical or virtual servers). - A set of
security server systems 202 a to 202 n are shown connected between theweb servers 204 a to 204 n and anetwork 210 such as the internet. Although both extend to n, the actual number of sub-systems could vary. For example, certain of the customers could install two separate security server systems to serve all of their web server systems (which could by one or more), such as for redundancy purposes. The particular security server systems 202 a-202 n may be matched to particular ones of the web server systems 204 a-204 n, or they may be at separate sites, and all of the web servers for various different customers may be provided with services by a single common set of security servers 202 a-202 n (e.g., when all of the server systems are at a single co-location facility so that bandwidth issues are minimized). - Each of the security server systems 202 a-202 n may be arranged and programmed to carry out operations like those discussed above and below and other operations. For example, a
policy engine 220 in each such security server system may evaluate HTTP requests from client computers (e.g., desktop, laptop, tablet, and smartphone computers) based on header and network information, and can set and store session information related to a relevant policy. The policy engine may be programmed to classify requests and correlate them to particular actions to be taken to code returned by the web server systems before such code is served back to a client computer. When such code returns, the policy information may be provided to a decode, analysis, and re-encode module, which matches the content to be delivered, across multiple content types (e.g., HTML, JavaScript, and CSS), to actions to be taken on the content (e.g., using XPATH within a DOM), such as substitutions, addition of content, and other actions that may be provided as extensions to the system. For example, the different types of content may be analyzed to determining naming that may extend across such different pieces of content (e.g., the name of a function or parameter), and such names may be changed in a way that differs each time the content is served, e.g., by replacing a named item with randomly-generated characters. Elements within the different types of content may first be group as having a common effect on the operation of the code, and then may be re-encoded together in a common manner so that their interoperation with each other will be consistent even after the re-encoding. - A
rules engine 222 may story analytical rules for performing such analysis and for re-encoding of the content. The rules engine may be populated with rules developed through operator observation of particular content types, such as by operators of a system studying typical web pages that call JavaScript content and recognizing that a particular method is frequently used in a particular manner. Such observation may result in therules engine 222 being programmed to identify the method and calls to the method so that they can all be grouped and re-encoded in a consistent and coordinated manner. - The decode, analysis, and
re-encode module 224 encodes content being passed to client computers from a web server according to relevant policies and rules. Themodule 224 also reverse encodes requests from the client computers to the relevant web server. For example, a web page may be served with a particular parameter, and may refer to JavaScript that references that same parameter. The decode, analysis, andre-encode module 224 may replace the name of that parameter, in each of the different types of content, with a randomly generated name, and each time the web page is served, the generated name may be different. When the name of the parameter is passed back to the web server, it may be re-encoded back to its original name so that this portion of the security process may occur seamless for the web server. - A key for the function that encodes and decodes such strings can be maintained by the security server system 202 along with an identifier for the particular client computer so that the system 202 may know which key or function to apply, and may otherwise maintaining a state for the client computer and its session. A stateless approach may also be employed, whereby the security server system 202 encrypts the state and stores it in a cookie that is saved at the relevant client computer. The client computer may then pass that cookie data back when it passes the information that needs to be decoded back to its original status. With the cookie data, the system 202 may use a private key to decrypt the state information and use that state information in real-time to decode the information from the client computer. Such a stateless implementation may create benefits such as less management overhead for the server system 202 (e.g., for tracking state, for storing state, and for performing clean-up of stored state information as sessions time out or otherwise end) and as a result, higher overall throughput.
- An
instrumentation module 226 is programmed to add active code to the content that is served from a web server. The instrumentation is code that is programmed to monitor the operation of other code that is served. For example, the instrumentation may be programmed to identify when certain methods are called, when those methods have been identified as likely to be called by malicious software. When such actions are observed by the instrumentation code to occur, the instrumentation code may be programmed to send a communication to the security server reporting on the type of action that occurred and other meta data that is helpful in characterizing the activity. Such information can be used to help determine whether the action was malicious or benign. - The instrumentation code may also analyze the DOM on a client computer in predetermined manners that are likely to identify the presence of and operation of malicious software, and to report to the security servers 202 or a related system. For example, the instrumentation code may be programmed to characterize a portion of the DOM when a user takes a particular action, such as clicking on a particular on-page button, so as to identify a change in the OM before and after the click (where the click is expected to cause a particular change to the DOM if there is benign code operating with respect to the click, as opposed to malicious code operating with respect to the click). Data that characterizes the DOM may also be hashed, either at the client computer or the server system 202, to produce a representation of the DOM that is easy to compare against corresponding representations of DOMs from other client computers. Other techniques may also be used by the instrumentation code to generate a compact representation of the DOM or other structure expected to be affected by malicious code in an identifiable manner.
- As noted, the content from web servers 204 a-204 n, as encoded by decode, analysis, and
re-encode module 224, may be rendered on web browsers of various client computers. Uninfected clients computers 212 a-212 n represent computers that do not have malicious code programmed to interfere with a particular site a user visits or to otherwise perform malicious activity. Infected clients computers 214 a-214 n represent computers that do have malicious code (218 a-218 n, respectively) programmed to interfere with a particular site a user visits or to otherwise perform malicious activity. In certain implementations, the client computers 212, 214 may also store the encrypted cookies discussed above and pass such cookies back through thenetwork 210. The client computers 212, 214 will, once they obtain the served content, implement DOMs for managing the displayed web pages, and instrumentation code may monitor the DOM as discussed above. Reports of illogical activity (e.g., software on the client device calling a method that does not exist in the downloaded and rendered content) - The reports from the instrumentation code may be analyzed and processed in various manners in order to determine how to respond to particular abnormal events, and to track down malicious code via analysis of multiple different similar interactions. For small-scale analysis, each web site operator may be provided with a
single security console 207 that provides analytical tools for a single site or group of sites. For example, theconsole 207 may include software for showing groups of abnormal activities, or reports that indicate the type of code served by the web site that generates the most abnormal activity. For example, a security officer for a bank may determine that defensive actions are needed if must of the reported abnormal activity for its web site relates to content elements corresponding to money transfer operations—an indication that stale malicious code may be trying to access such elements surreptitiously. - A central security console may connect to a large number of web content providers, and may be run, for example, by an organization that provides the software for operating the security server systems 202 a-202 n.
Such console 208 may access complex analytical and data analysis tools, such as tools that identify clustering of abnormal activities across thousands of client computers and sessions, so that an operator of theconsole 208 can focus on those cluster in order to diagnose them as malicious or benign, and then take steps to thwart any malicious activity. - In certain other implementations, the
console 208 may have access to software for analyzing telemetry data received from a very large number of client computers that execute instrumentation code provided by thesystem 200. Such data may result from forms being re-written across a large number of web pages and web sites to include content that collects system information such as browser version, installed plug-ins, screen resolution, window size and position, operating system, network information, and the like. In addition, user interaction with served content may be characterized by such code, such as the speed with which a user interacts with a page, the path of a pointer over the page, and the like. Such collected telemetry data, across many thousands of sessions, may be used by theconsole 208 to identify what is “natural” interaction with a particular page and what is “unnatural” interaction that is likely the result of a bot interacting with the content. Statistical and machine learning methods may be used to identify patterns in such telemetry data, and to resolve bot candidates to particular client computers. Such client computers may then be handled in special manners by thesystem 200, may be blocked from interaction, or may have their operators notified that their computer is running bad software. -
FIG. 3 is a flow chart of a process for transforming code passed over the internet. In general, in general, the process involves receiving content to be served to a client device and transforming that content so as to obscure the operation of the webpage that serves the content, so that malicious code cannot attempt to take advantage of such operation of the webpage. The process also involves receiving requests from a client to which the content was served, and using information passed with the request to reverse transform the provided content, and then provide that transformed content to a Web server that serves the original webpage. - The process begins a box at 302, where code to be served is received, such as from a web server that is connected to a security server system. At
box 304, the security server system modifies the code to obscure its operation. For example, as discussed above, names of methods, functions, parameters, and other items may be changed into seemingly random strings of text, where the changes are made consistently across HTML code, CSS code, and JavaScript code, so that calls between the different types of codes can be properly answered after the transformation (e.g., when the types of code are executed on the client device). - At
box 306, the transformation information is generated. Generally, such information would be generated before the modification so that it could be used in performing the modification, such as by providing the transformation information to a function that transforms the content and uses the provided information as a parameter for the transformation. The step here involves taking the transformation information and packaging it for transmission to the client device. Atbox 308, the modified code and the transformation information are served to the client device. Such service involves transmission in a single communication, or the transformed content may be provided separately from the transformation information. The transformation information may be provided in a manner that it will exhibit its self as a cookie or similar item on the client device. - At
box 310, the system receives a subsequent request from the client device. The request may take a variety of forms, and may be generated as a result of a user interaction with the web page that was served to the client device. For example, perhaps a user of the client device chooses to enter text into a form on his or her bank web page so as to transfer funds between accounts. When the user clicks a button to execute the transfer, a request may be sent back to the Web server for the bank and be intercepted by a security subsystem. The request may have the transformation information appended to it, and the security subsystem may use such transformation information in the same manner it was used when initially transforming the content to be served. However in this instance, the transformation is operated in the reverse direction, so that transformed text may be reverted to its original form that was served by the Web server. Thus, atbox 312, the received request is unpacked and decoded, and it least a portion of the request is passed to the Web server in its reverse transformed format. -
FIG. 4 shows a process for encryption. The process generally follows the format of AES encryption using CCM block mode (e.g., RFC 3610 and NIST special publication 800-38C), to provide both assurance and confidentiality and authenticity of a serialized data structure provided to the client device. This is the same block mode used for WPA2 in the IEEE 802.11i standard. The use of the nonce as illustrated in the earlier example case is required for the CCM block mode of operation. The nonce is not a secret, but should have a very high probability of being unique and be unpredictable. A 112 bit random number provides sufficient probability and leaves 16 bits for the counter in a 128 bit block. The nonce should be passed in the clear, as it is required (in addition to the key) to decrypt the ciphertext. To facilitate this approach with key management, all security servers for a given web site share a common, but randomly chosen, 256 bit key. - The potential for replay attacks from storing information at a client device can be mitigated by (a) including a timestamp in the encrypted cookie, so that GETs/POSTs received after a reasonable amount of time are simply ignored; and (2) keeping at each security server a circular buffer of processed (received) nonces, so that the servers refuse subsequent GETs/POSTs reusing the same nonce. Nonces in the buffer older than the timeout value can be discarded.
-
FIG. 5 is a schematic diagram of a computer system 500. The system 500 can be used for the operations described in association with any of the computer-implement methods described previously, according to one implementation. The system 500 is intended to include various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The system 500 can also include mobile devices, such as personal digital assistants, cellular telephones, smartphones, and other similar computing devices. Additionally the system can include portable storage media, such as, Universal Serial Bus (USB) flash drives. For example, the USB flash drives may store operating systems and other applications. The USB flash drives can include input/output components, such as a wireless transmitter or USB connector that may be inserted into a USB port of another computing device. - The system 500 includes a
processor 510, amemory 520, astorage device 530, and an input/output device 540. Each of thecomponents system bus 550. Theprocessor 510 is capable of processing instructions for execution within the system 500. The processor may be designed using any of a number of architectures. For example, theprocessor 510 may be a CISC (Complex Instruction Set Computers) processor, a RISC (Reduced Instruction Set Computer) processor, or a MISC (Minimal Instruction Set Computer) processor. - In one implementation, the
processor 510 is a single-threaded processor. In another implementation, theprocessor 510 is a multi-threaded processor. Theprocessor 510 is capable of processing instructions stored in thememory 520 or on thestorage device 530 to display graphical information for a user interface on the input/output device 540. - The
memory 520 stores information within the system 500. In one implementation, thememory 520 is a computer-readable medium. In one implementation, thememory 520 is a volatile memory unit. In another implementation, thememory 520 is a non-volatile memory unit. - The
storage device 530 is capable of providing mass storage for the system 500. In one implementation, thestorage device 530 is a computer-readable medium. In various different implementations, thestorage device 530 may be a floppy disk device, a hard disk device, an optical disk device, or a tape device. - The input/output device 540 provides input/output operations for the system 500. In one implementation, the input/output device 540 includes a keyboard and/or pointing device. In another implementation, the input/output device 640 includes a display unit for displaying graphical user interfaces.
- The features described can be implemented in digital electronic circuitry, or in computer hardware, firmware, software, or in combinations of them. The apparatus can be implemented in a computer program product tangibly embodied in an information carrier, e.g., in a machine-readable storage device for execution by a programmable processor; and method steps can be performed by a programmable processor executing a program of instructions to perform functions of the described implementations by operating on input data and generating output. The described features can be implemented advantageously in one or more computer programs that are executable on a programmable system including at least one programmable processor coupled to receive data and instructions from, and to transmit data and instructions to, a data storage system, at least one input device, and at least one output device. A computer program is a set of instructions that can be used, directly or indirectly, in a computer to perform a certain activity or bring about a certain result. A computer program can be written in any form of programming language, including compiled or interpreted languages, and it can be deployed in any form, including as a stand-alone program or as a module, component, subroutine, or other unit suitable for use in a computing environment.
- Suitable processors for the execution of a program of instructions include, by way of example, both general and special purpose microprocessors, and the sole processor or one of multiple processors of any kind of computer. Generally, a processor will receive instructions and data from a read-only memory or a random access memory or both. The essential elements of a computer are a processor for executing instructions and one or more memories for storing instructions and data. Generally, a computer will also include, or be operatively coupled to communicate with, one or more mass storage devices for storing data files; such devices include magnetic disks, such as internal hard disks and removable disks; magneto-optical disks; and optical disks. Storage devices suitable for tangibly embodying computer program instructions and data include all forms of non-volatile memory, including by way of example semiconductor memory devices, such as EPROM, EEPROM, and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, ASICs (application-specific integrated circuits).
- To provide for interaction with a user, the features can be implemented on a computer having a display device such as a CRT (cathode ray tube) or LCD (liquid crystal display) monitor for displaying information to the user and a keyboard and a pointing device such as a mouse or a trackball by which the user can provide input to the computer. Additionally, such activities can be implemented via touchscreen flat-panel displays and other appropriate mechanisms.
- The features can be implemented in a computer system that includes a back-end component, such as a data server, or that includes a middleware component, such as an application server or an Internet server, or that includes a front-end component, such as a client computer having a graphical user interface or an Internet browser, or any combination of them. The components of the system can be connected by any form or medium of digital data communication such as a communication network. Examples of communication networks include a local area network (“LAN”), a wide area network (“WAN”), peer-to-peer networks (having ad-hoc or static members), grid computing infrastructures, and the Internet.
- The computer system can include clients and servers. A client and server are generally remote from each other and typically interact through a network, such as the described one. The relationship of client and server arises by virtue of computer programs running on the respective computers and having a client-server relationship to each other.
- While this specification contains many specific implementation details, these should not be construed as limitations on the scope of any inventions or of what may be claimed, but rather as descriptions of features specific to particular implementations of particular inventions. Certain features that are described in this specification in the context of separate implementations can also be implemented in combination in a single implementation. Conversely, various features that are described in the context of a single implementation can also be implemented in multiple implementations separately or in any suitable subcombination. Moreover, although features may be described above as acting in certain combinations and even initially claimed as such, one or more features from a claimed combination can in some cases be excised from the combination, and the claimed combination may be directed to a subcombination or variation of a subcombination.
- Similarly, while operations are depicted in the drawings in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Moreover, the separation of various system components in the implementations described above should not be understood as requiring such separation in all implementations, and it should be understood that the described program components and systems can generally be integrated together in a single software product or packaged into multiple software products.
- Thus, particular implementations of the subject matter have been described. Other implementations are within the scope of the following claims. In some cases, the actions recited in the claims can be performed in a different order and still achieve desirable results. In addition, the processes depicted in the accompanying figures do not necessarily require the particular order shown, or sequential order, to achieve desirable results. In certain implementations, multitasking and parallel processing may be advantageous. In some implementations, the subject matter may be embodied as methods, systems, devices, and/or as an article or computer program product. The article or computer program product may comprise one or more computer-readable media or computer-readable storage devices, which may be tangible and non-transitory, that include instructions that may be executable by one or more machines such as computer processors.
Claims (16)
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US14/055,714 US9338143B2 (en) | 2013-03-15 | 2013-10-16 | Stateless web content anti-automation |
PCT/US2014/023897 WO2014150659A1 (en) | 2013-03-15 | 2014-03-12 | Stateless web content anti-automation |
US15/148,139 US10205742B2 (en) | 2013-03-15 | 2016-05-06 | Stateless web content anti-automation |
US16/233,455 US20190243951A1 (en) | 2013-03-15 | 2018-12-27 | Stateless web content anti-automation |
Applications Claiming Priority (2)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US201361801142P | 2013-03-15 | 2013-03-15 | |
US14/055,714 US9338143B2 (en) | 2013-03-15 | 2013-10-16 | Stateless web content anti-automation |
Related Child Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/148,139 Continuation US10205742B2 (en) | 2013-03-15 | 2016-05-06 | Stateless web content anti-automation |
Publications (2)
Publication Number | Publication Date |
---|---|
US20140282872A1 true US20140282872A1 (en) | 2014-09-18 |
US9338143B2 US9338143B2 (en) | 2016-05-10 |
Family
ID=51534977
Family Applications (3)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US14/055,714 Active 2033-12-15 US9338143B2 (en) | 2013-03-15 | 2013-10-16 | Stateless web content anti-automation |
US15/148,139 Active US10205742B2 (en) | 2013-03-15 | 2016-05-06 | Stateless web content anti-automation |
US16/233,455 Abandoned US20190243951A1 (en) | 2013-03-15 | 2018-12-27 | Stateless web content anti-automation |
Family Applications After (2)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/148,139 Active US10205742B2 (en) | 2013-03-15 | 2016-05-06 | Stateless web content anti-automation |
US16/233,455 Abandoned US20190243951A1 (en) | 2013-03-15 | 2018-12-27 | Stateless web content anti-automation |
Country Status (2)
Country | Link |
---|---|
US (3) | US9338143B2 (en) |
WO (1) | WO2014150659A1 (en) |
Cited By (39)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150082440A1 (en) * | 2013-09-18 | 2015-03-19 | Jeremy Dale Pickett | Detection of man in the browser style malware using namespace inspection |
US20150112892A1 (en) * | 2012-10-18 | 2015-04-23 | Daniel Kaminsky | System and method for detecting classes of automated browser agents |
US9270647B2 (en) | 2013-12-06 | 2016-02-23 | Shape Security, Inc. | Client/server security by an intermediary rendering modified in-memory objects |
US20160119344A1 (en) * | 2013-07-04 | 2016-04-28 | Jscrambler S.A. | System and method for web application security |
US20160127412A1 (en) * | 2014-11-05 | 2016-05-05 | Samsung Electronics Co., Ltd. | Method and system for detecting execution of a malicious code in a web based operating system |
US9438625B1 (en) | 2014-09-09 | 2016-09-06 | Shape Security, Inc. | Mitigating scripted attacks using dynamic polymorphism |
US9479529B2 (en) | 2014-07-22 | 2016-10-25 | Shape Security, Inc. | Polymorphic security policy action |
US9501273B1 (en) * | 2015-09-25 | 2016-11-22 | International Business Machines Corporation | Data sharing |
US20160344769A1 (en) * | 2015-05-21 | 2016-11-24 | Shape Security, Inc | Security systems for mitigating attacks from a headless browser executing on a client computer |
US20160364566A1 (en) * | 2014-09-23 | 2016-12-15 | Intel Corporation | Technologies for multi-factor security analysis and runtime control |
WO2017007705A1 (en) * | 2015-07-06 | 2017-01-12 | Shape Security, Inc. | Asymmetrical challenges for web security |
US9602543B2 (en) | 2014-09-09 | 2017-03-21 | Shape Security, Inc. | Client/server polymorphism using polymorphic hooks |
US20170147828A1 (en) * | 2015-11-24 | 2017-05-25 | Bank Of America Corporation | Reversible Redaction and Tokenization Computing System |
US20170147829A1 (en) * | 2015-11-24 | 2017-05-25 | Bank Of America Corporation | Reversible Redaction and Tokenization Computing System |
US9712561B2 (en) | 2014-01-20 | 2017-07-18 | Shape Security, Inc. | Intercepting and supervising, in a runtime environment, calls to one or more objects in a web page |
US20170257385A1 (en) * | 2016-03-02 | 2017-09-07 | Shape Security, Inc. | Variable runtime transpilation |
US9794276B2 (en) | 2013-03-15 | 2017-10-17 | Shape Security, Inc. | Protecting against the introduction of alien content |
US9858440B1 (en) * | 2014-05-23 | 2018-01-02 | Shape Security, Inc. | Encoding of sensitive data |
US9967273B2 (en) * | 2015-06-15 | 2018-05-08 | Microsoft Technology Licensing, Llc. | Abusive traffic detection |
US10135718B2 (en) * | 2014-11-07 | 2018-11-20 | Iac Search & Media, Inc. | Service pack deployment in a method and system for providing answers to requests |
US10187408B1 (en) | 2014-04-17 | 2019-01-22 | Shape Security, Inc. | Detecting attacks against a server computer based on characterizing user interactions with the client computing device |
US10275596B1 (en) * | 2016-12-15 | 2019-04-30 | Symantec Corporation | Activating malicious actions within electronic documents |
US10282550B1 (en) * | 2015-03-12 | 2019-05-07 | Whitehat Security, Inc. | Auto-remediation workflow for computer security testing |
US10333924B2 (en) | 2014-07-01 | 2019-06-25 | Shape Security, Inc. | Reliable selection of security countermeasures |
US10375026B2 (en) * | 2015-10-28 | 2019-08-06 | Shape Security, Inc. | Web transaction status tracking |
US10382482B2 (en) | 2015-08-31 | 2019-08-13 | Shape Security, Inc. | Polymorphic obfuscation of executable code |
US20190327267A1 (en) * | 2018-04-24 | 2019-10-24 | International Business Machines Corporation | Phishing detection through secure testing implementation |
US10536479B2 (en) | 2013-03-15 | 2020-01-14 | Shape Security, Inc. | Code modification for automation detection |
US10601868B2 (en) * | 2018-08-09 | 2020-03-24 | Microsoft Technology Licensing, Llc | Enhanced techniques for generating and deploying dynamic false user accounts |
US10701079B1 (en) | 2016-12-15 | 2020-06-30 | Open Invention Network Llc | Collaborative data sharing and co-browsing with natural language masking |
US10749885B1 (en) * | 2019-07-18 | 2020-08-18 | Cyberark Software Ltd. | Agentless management and control of network sessions |
US10824719B1 (en) * | 2017-08-01 | 2020-11-03 | Rodney E. Otts | Anti-malware computer systems and method |
US10873599B1 (en) * | 2017-07-11 | 2020-12-22 | Zycada Networks, Inc. | Providing application security using causal graph |
US20210126944A1 (en) * | 2019-10-25 | 2021-04-29 | Target Brands, Inc. | Analysis of potentially malicious emails |
US20210136085A1 (en) * | 2019-11-05 | 2021-05-06 | GlassBox Ltd. | System and method for detecting potential information fabrication attempts on a webpage |
US11212312B2 (en) | 2018-08-09 | 2021-12-28 | Microsoft Technology Licensing, Llc | Systems and methods for polluting phishing campaign responses |
US11290481B2 (en) * | 2020-07-09 | 2022-03-29 | Bank Of America Corporation | Security threat detection by converting scripts using validation graphs |
US20220191172A1 (en) * | 2020-02-05 | 2022-06-16 | Shopify Inc. | Systems and methods for web traffic control |
US11948022B2 (en) * | 2017-11-22 | 2024-04-02 | Amazon Technologies, Inc. | Using a client to manage remote machine learning jobs |
Families Citing this family (21)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US9225737B2 (en) | 2013-03-15 | 2015-12-29 | Shape Security, Inc. | Detecting the introduction of alien content |
US9338143B2 (en) | 2013-03-15 | 2016-05-10 | Shape Security, Inc. | Stateless web content anti-automation |
US8893294B1 (en) | 2014-01-21 | 2014-11-18 | Shape Security, Inc. | Flexible caching |
US9225729B1 (en) | 2014-01-21 | 2015-12-29 | Shape Security, Inc. | Blind hash compression |
US10089216B2 (en) | 2014-06-30 | 2018-10-02 | Shape Security, Inc. | Automatically determining whether a page of a web site is broken despite elements on the page that may change |
US9954893B1 (en) | 2014-09-23 | 2018-04-24 | Shape Security, Inc. | Techniques for combating man-in-the-browser attacks |
US9800602B2 (en) | 2014-09-30 | 2017-10-24 | Shape Security, Inc. | Automated hardening of web page content |
US9529994B2 (en) | 2014-11-24 | 2016-12-27 | Shape Security, Inc. | Call stack integrity check on client/server systems |
US10230718B2 (en) | 2015-07-07 | 2019-03-12 | Shape Security, Inc. | Split serving of computer code |
US10817913B2 (en) * | 2015-10-16 | 2020-10-27 | Akamai Technologies, Inc. | Server-side detection and mitigation of client-side content filters |
EP3440542B1 (en) | 2016-03-09 | 2021-04-28 | Shape Security, Inc. | Applying bytecode obfuscation techniques to programs written in an interpreted language |
US10216488B1 (en) | 2016-03-14 | 2019-02-26 | Shape Security, Inc. | Intercepting and injecting calls into operations and objects |
US10225255B1 (en) | 2016-05-27 | 2019-03-05 | Shape Security, Inc. | Count-based challenge-response credential pairs for client/server request validation |
WO2018102767A1 (en) | 2016-12-02 | 2018-06-07 | Shape Security, Inc. | Obfuscating source code sent, from a server computer, to a browser on a client computer |
US10715535B1 (en) * | 2016-12-30 | 2020-07-14 | Wells Fargo Bank, N.A. | Distributed denial of service attack mitigation |
US11368477B2 (en) * | 2019-05-13 | 2022-06-21 | Securitymetrics, Inc. | Webpage integrity monitoring |
EP4004773B1 (en) | 2019-07-29 | 2023-09-06 | Intertrust Technologies Corporation | Systems and methods for managing state |
US11741197B1 (en) | 2019-10-15 | 2023-08-29 | Shape Security, Inc. | Obfuscating programs using different instruction set architectures |
US11281803B2 (en) * | 2019-12-11 | 2022-03-22 | Sap Se | Obfuscating content based on requesting user roles |
CN112291352A (en) * | 2020-10-30 | 2021-01-29 | 杭州安恒信息安全技术有限公司 | Protection method, device, equipment and medium for database collision and brute force cracking |
US11556637B2 (en) | 2021-04-05 | 2023-01-17 | Bank Of America Corporation | Information security system and method for anomaly and security threat detection |
Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110255689A1 (en) * | 2010-04-15 | 2011-10-20 | Lsi Corporation | Multiple-mode cryptographic module usable with memory controllers |
US20120124372A1 (en) * | 2010-10-13 | 2012-05-17 | Akamai Technologies, Inc. | Protecting Websites and Website Users By Obscuring URLs |
US20120198528A1 (en) * | 2011-02-01 | 2012-08-02 | Symbiotic Technologise Pty Ltd | Methods and systems to detect attacks on internet transactions |
Family Cites Families (152)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
CN1312549C (en) | 1995-02-13 | 2007-04-25 | 英特特拉斯特技术公司 | Systems and methods for secure transaction management and electronic rights protection |
US6266684B1 (en) | 1997-08-06 | 2001-07-24 | Adobe Systems Incorporated | Creating and saving multi-frame web pages |
SE512672C2 (en) | 1998-06-12 | 2000-04-17 | Ericsson Telefon Ab L M | Procedure and system for transferring a cookie |
US6697948B1 (en) | 1999-05-05 | 2004-02-24 | Michael O. Rabin | Methods and apparatus for protecting information |
US7430670B1 (en) | 1999-07-29 | 2008-09-30 | Intertrust Technologies Corp. | Software self-defense systems and methods |
US6938170B1 (en) * | 2000-07-17 | 2005-08-30 | International Business Machines Corporation | System and method for preventing automated crawler access to web-based data sources using a dynamic data transcoding scheme |
US7024479B2 (en) | 2001-01-22 | 2006-04-04 | Intel Corporation | Filtering calls in system area networks |
US7171443B2 (en) | 2001-04-04 | 2007-01-30 | Prodigy Communications, Lp | Method, system, and software for transmission of information |
WO2002088951A1 (en) | 2001-04-26 | 2002-11-07 | Telefonaktiebolaget Lm Ericsson (Publ) | Stateless server |
US7028305B2 (en) | 2001-05-16 | 2006-04-11 | Softricity, Inc. | Operating system abstraction and protection layer |
US7010779B2 (en) | 2001-08-16 | 2006-03-07 | Knowledge Dynamics, Inc. | Parser, code generator, and data calculation and transformation engine for spreadsheet calculations |
US7975296B2 (en) | 2002-02-07 | 2011-07-05 | Oracle International Corporation | Automated security threat testing of web pages |
US7114160B2 (en) | 2002-04-17 | 2006-09-26 | Sbc Technology Resources, Inc. | Web content customization via adaptation Web services |
US20040162994A1 (en) | 2002-05-13 | 2004-08-19 | Sandia National Laboratories | Method and apparatus for configurable communication network defenses |
US7117429B2 (en) | 2002-06-12 | 2006-10-03 | Oracle International Corporation | Methods and systems for managing styles electronic documents |
US9009084B2 (en) | 2002-10-21 | 2015-04-14 | Rockwell Automation Technologies, Inc. | System and methodology providing automation security analysis and network intrusion protection in an industrial environment |
US7877681B2 (en) | 2002-12-05 | 2011-01-25 | Borland Software Corporation | Automatic context management for web applications with client side code execution |
US20050216770A1 (en) | 2003-01-24 | 2005-09-29 | Mistletoe Technologies, Inc. | Intrusion detection system |
US7735144B2 (en) | 2003-05-16 | 2010-06-08 | Adobe Systems Incorporated | Document modification detection and prevention |
US7500099B1 (en) | 2003-05-16 | 2009-03-03 | Microsoft Corporation | Method for mitigating web-based “one-click” attacks |
US7707634B2 (en) | 2004-01-30 | 2010-04-27 | Microsoft Corporation | System and method for detecting malware in executable scripts according to its functionality |
US20050198099A1 (en) | 2004-02-24 | 2005-09-08 | Covelight Systems, Inc. | Methods, systems and computer program products for monitoring protocol responses for a server application |
US7424720B2 (en) | 2004-03-25 | 2008-09-09 | International Business Machines Corporation | Process and implementation for dynamically determining probe enablement using out of process correlating token |
US7475341B2 (en) | 2004-06-15 | 2009-01-06 | At&T Intellectual Property I, L.P. | Converting the format of a portion of an electronic document |
US8181104B1 (en) | 2004-08-31 | 2012-05-15 | Adobe Systems Incorporated | Automatic creation of cascading style sheets |
US7480385B2 (en) | 2004-11-05 | 2009-01-20 | Cable Television Laboratories, Inc. | Hierarchical encryption key system for securing digital media |
US8850565B2 (en) | 2005-01-10 | 2014-09-30 | Hewlett-Packard Development Company, L.P. | System and method for coordinating network incident response activities |
US20060230288A1 (en) | 2005-03-29 | 2006-10-12 | International Business Machines Corporation | Source code classification method for malicious code detection |
WO2006113722A2 (en) | 2005-04-18 | 2006-10-26 | The Regents Of The University Of California | High-performance context-free parser for polymorphic malware detection |
US7707223B2 (en) | 2005-04-28 | 2010-04-27 | Cisco Technology, Inc. | Client-side java content transformation |
WO2007025279A2 (en) | 2005-08-25 | 2007-03-01 | Fortify Software, Inc. | Apparatus and method for analyzing and supplementing a program to provide security |
US7770185B2 (en) | 2005-09-26 | 2010-08-03 | Bea Systems, Inc. | Interceptor method and system for web services for remote portlets |
US7849509B2 (en) | 2005-10-07 | 2010-12-07 | Microsoft Corporation | Detection of security vulnerabilities in computer programs |
US8079037B2 (en) | 2005-10-11 | 2011-12-13 | Knoa Software, Inc. | Generic, multi-instance method and GUI detection system for tracking and monitoring computer applications |
US8108689B2 (en) | 2005-10-28 | 2012-01-31 | Panasonic Corporation | Obfuscation evaluation method and obfuscation method |
US8170020B2 (en) | 2005-12-08 | 2012-05-01 | Microsoft Corporation | Leveraging active firewalls for network intrusion detection and retardation of attack |
US8086756B2 (en) | 2006-01-25 | 2011-12-27 | Cisco Technology, Inc. | Methods and apparatus for web content transformation and delivery |
US8407482B2 (en) * | 2006-03-31 | 2013-03-26 | Avaya Inc. | User session dependent URL masking |
US8601064B1 (en) | 2006-04-28 | 2013-12-03 | Trend Micro Incorporated | Techniques for defending an email system against malicious sources |
US8656006B2 (en) | 2006-05-11 | 2014-02-18 | Ca, Inc. | Integrating traffic monitoring data and application runtime data |
GB0620855D0 (en) | 2006-10-19 | 2006-11-29 | Dovetail Software Corp Ltd | Data processing apparatus and method |
US8613080B2 (en) | 2007-02-16 | 2013-12-17 | Veracode, Inc. | Assessment and analysis of software security flaws in virtual machines |
US20080222736A1 (en) | 2007-03-07 | 2008-09-11 | Trusteer Ltd. | Scrambling HTML to prevent CSRF attacks and transactional crimeware attacks |
US7870610B1 (en) | 2007-03-16 | 2011-01-11 | The Board Of Directors Of The Leland Stanford Junior University | Detection of malicious programs |
CN101276362B (en) | 2007-03-26 | 2011-05-11 | 国际商业机器公司 | Apparatus and method for customizing web page |
US7895653B2 (en) | 2007-05-31 | 2011-02-22 | International Business Machines Corporation | Internet robot detection for network distributable markup |
US8527757B2 (en) | 2007-06-22 | 2013-09-03 | Gemalto Sa | Method of preventing web browser extensions from hijacking user information |
US20090007243A1 (en) | 2007-06-27 | 2009-01-01 | Trusteer Ltd. | Method for rendering password theft ineffective |
US8510431B2 (en) | 2007-07-13 | 2013-08-13 | Front Porch, Inc. | Method and apparatus for internet traffic monitoring by third parties using monitoring implements transmitted via piggybacking HTTP transactions |
WO2009033137A1 (en) | 2007-09-07 | 2009-03-12 | Dis-Ent, Llc | Software based multi-channel polymorphic data obfuscation |
US7941382B2 (en) | 2007-10-12 | 2011-05-10 | Microsoft Corporation | Method of classifying and active learning that ranks entries based on multiple scores, presents entries to human analysts, and detects and/or prevents malicious behavior |
US9509714B2 (en) | 2014-05-22 | 2016-11-29 | Cabara Software Ltd. | Web page and web browser protection against malicious injections |
US8260845B1 (en) | 2007-11-21 | 2012-09-04 | Appcelerator, Inc. | System and method for auto-generating JavaScript proxies and meta-proxies |
US8347396B2 (en) | 2007-11-30 | 2013-01-01 | International Business Machines Corporation | Protect sensitive content for human-only consumption |
CN101471818B (en) | 2007-12-24 | 2011-05-04 | 北京启明星辰信息技术股份有限公司 | Detection method and system for malevolence injection script web page |
US8646067B2 (en) | 2008-01-26 | 2014-02-04 | Citrix Systems, Inc. | Policy driven fine grain URL encoding mechanism for SSL VPN clientless access |
US20090192848A1 (en) | 2008-01-30 | 2009-07-30 | Gerald Rea | Method and apparatus for workforce assessment |
US20090241174A1 (en) | 2008-02-19 | 2009-09-24 | Guru Rajan | Handling Human Detection for Devices Connected Over a Network |
US9317255B2 (en) | 2008-03-28 | 2016-04-19 | Microsoft Technology Licensing, LCC | Automatic code transformation with state transformer monads |
CA2630388A1 (en) | 2008-05-05 | 2009-11-05 | Nima Sharifmehr | Apparatus and method to prevent man in the middle attack |
US8086957B2 (en) | 2008-05-21 | 2011-12-27 | International Business Machines Corporation | Method and system to selectively secure the display of advertisements on web browsers |
KR100987354B1 (en) | 2008-05-22 | 2010-10-12 | 주식회사 이베이지마켓 | System for checking false code in website and Method thereof |
CN102217225B (en) | 2008-10-03 | 2014-04-02 | 杰出网络公司 | Content delivery network encryption |
US7953850B2 (en) | 2008-10-03 | 2011-05-31 | Computer Associates Think, Inc. | Monitoring related content requests |
US8020193B2 (en) | 2008-10-20 | 2011-09-13 | International Business Machines Corporation | Systems and methods for protecting web based applications from cross site request forgery attacks |
US8434068B2 (en) | 2008-10-23 | 2013-04-30 | XMOS Ltd. | Development system |
US20100106611A1 (en) | 2008-10-24 | 2010-04-29 | Uc Group Ltd. | Financial transactions systems and methods |
US8526306B2 (en) | 2008-12-05 | 2013-09-03 | Cloudshield Technologies, Inc. | Identification of patterns in stateful transactions |
US8225401B2 (en) | 2008-12-18 | 2012-07-17 | Symantec Corporation | Methods and systems for detecting man-in-the-browser attacks |
CN101788982B (en) | 2009-01-22 | 2013-03-06 | 国际商业机器公司 | Method of cross-domain interaction and for protecting Web application in unmodified browser and system thereof |
CN101482882A (en) | 2009-02-17 | 2009-07-15 | 阿里巴巴集团控股有限公司 | Method and system for cross-domain treatment of COOKIE |
US8413239B2 (en) | 2009-02-22 | 2013-04-02 | Zscaler, Inc. | Web security via response injection |
US20100235636A1 (en) | 2009-03-12 | 2010-09-16 | Postalguard Ltd. | Method for delivering web content and applications to the user via email or other communication channels |
EP2406717A4 (en) | 2009-03-13 | 2012-12-26 | Univ Rutgers | Systems and methods for the detection of malware |
US20100240449A1 (en) | 2009-03-19 | 2010-09-23 | Guy Corem | System and method for controlling usage of executable code |
US9311425B2 (en) | 2009-03-31 | 2016-04-12 | Qualcomm Incorporated | Rendering a page using a previously stored DOM associated with a different page |
US8838628B2 (en) | 2009-04-24 | 2014-09-16 | Bonnie Berger Leighton | Intelligent search tool for answering clinical queries |
US8332952B2 (en) | 2009-05-22 | 2012-12-11 | Microsoft Corporation | Time window based canary solutions for browser security |
US8527774B2 (en) | 2009-05-28 | 2013-09-03 | Kaazing Corporation | System and methods for providing stateless security management for web applications using non-HTTP communications protocols |
US8924943B2 (en) | 2009-07-17 | 2014-12-30 | Ebay Inc. | Browser emulator system |
US8776218B2 (en) | 2009-07-21 | 2014-07-08 | Sophos Limited | Behavioral-based host intrusion prevention system |
US11102325B2 (en) | 2009-10-23 | 2021-08-24 | Moov Corporation | Configurable and dynamic transformation of web content |
US8539224B2 (en) | 2009-11-05 | 2013-09-17 | International Business Machines Corporation | Obscuring form data through obfuscation |
US8775818B2 (en) | 2009-11-30 | 2014-07-08 | Red Hat, Inc. | Multifactor validation of requests to thwart dynamic cross-site attacks |
US8640216B2 (en) | 2009-12-23 | 2014-01-28 | Citrix Systems, Inc. | Systems and methods for cross site forgery protection |
US8660976B2 (en) | 2010-01-20 | 2014-02-25 | Microsoft Corporation | Web content rewriting, including responses |
WO2011106440A1 (en) | 2010-02-23 | 2011-09-01 | Loma Linda University Medical Center | Method of analyzing a medical image |
CA2694326A1 (en) | 2010-03-10 | 2010-05-18 | Ibm Canada Limited - Ibm Canada Limitee | A method and system for preventing cross-site request forgery attacks on a server |
US20110231305A1 (en) | 2010-03-19 | 2011-09-22 | Visa U.S.A. Inc. | Systems and Methods to Identify Spending Patterns |
US9369437B2 (en) | 2010-04-01 | 2016-06-14 | Cloudflare, Inc. | Internet-based proxy service to modify internet responses |
WO2011130228A2 (en) | 2010-04-12 | 2011-10-20 | Google Inc. | Scrolling in large hosted data set |
US8739150B2 (en) | 2010-05-28 | 2014-05-27 | Smartshift Gmbh | Systems and methods for dynamically replacing code objects via conditional pattern templates |
US8631091B2 (en) | 2010-10-15 | 2014-01-14 | Northeastern University | Content distribution network using a web browser and locally stored content to directly exchange content between users |
KR20120072266A (en) | 2010-12-23 | 2012-07-03 | 한국전자통신연구원 | Apparatus for controlling security condition of a global network |
CN103392320B (en) | 2010-12-29 | 2016-08-31 | 思杰系统有限公司 | Encrypted item is carried out the system and method that multilamellar labelling determines to provide extra safely effectively encrypted item |
US8667565B2 (en) | 2011-02-18 | 2014-03-04 | Microsoft Corporation | Security restructuring for web media |
US8732571B2 (en) | 2011-03-31 | 2014-05-20 | Google Inc. | Methods and systems for generating and displaying a preview image of a content area |
US9456050B1 (en) | 2011-04-11 | 2016-09-27 | Viasat, Inc. | Browser optimization through user history analysis |
US8555388B1 (en) | 2011-05-24 | 2013-10-08 | Palo Alto Networks, Inc. | Heuristic botnet detection |
US8966643B2 (en) | 2011-10-08 | 2015-02-24 | Broadcom Corporation | Content security in a social network |
WO2013091709A1 (en) | 2011-12-22 | 2013-06-27 | Fundació Privada Barcelona Digital Centre Tecnologic | Method and apparatus for real-time dynamic transformation of the code of a web document |
US10049168B2 (en) | 2012-01-31 | 2018-08-14 | Openwave Mobility, Inc. | Systems and methods for modifying webpage data |
US20130227397A1 (en) | 2012-02-24 | 2013-08-29 | Microsoft Corporation | Forming an instrumented text source document for generating a live web page |
US8661549B2 (en) | 2012-03-02 | 2014-02-25 | Apple Inc. | Method and apparatus for obfuscating program source codes |
EP2642715A1 (en) | 2012-03-20 | 2013-09-25 | British Telecommunications public limited company | Method and system for malicious code detection |
US9111090B2 (en) | 2012-04-02 | 2015-08-18 | Trusteer, Ltd. | Detection of phishing attempts |
GB2501267B (en) | 2012-04-17 | 2016-10-26 | Bango Net Ltd | Payment authentication systems |
US20140089786A1 (en) | 2012-06-01 | 2014-03-27 | Atiq Hashmi | Automated Processor For Web Content To Mobile-Optimized Content Transformation |
US9165125B2 (en) | 2012-06-13 | 2015-10-20 | Mobilextension Inc. | Distribution of dynamic structured content |
US8595613B1 (en) | 2012-07-26 | 2013-11-26 | Viasat Inc. | Page element identifier pre-classification for user interface behavior in a communications system |
US9626678B2 (en) | 2012-08-01 | 2017-04-18 | Visa International Service Association | Systems and methods to enhance security in transactions |
WO2014041561A2 (en) | 2012-08-31 | 2014-03-20 | Iappsecure Solutions Pvt. Ltd. | A system for analyzing applications accurately for finding security and quality issues |
US9313213B2 (en) | 2012-10-18 | 2016-04-12 | White Ops, Inc. | System and method for detecting classes of automated browser agents |
US8806627B1 (en) | 2012-12-17 | 2014-08-12 | Emc Corporation | Content randomization for thwarting malicious software attacks |
RU2522019C1 (en) | 2012-12-25 | 2014-07-10 | Закрытое акционерное общество "Лаборатория Касперского" | System and method of detecting threat in code executed by virtual machine |
US9584543B2 (en) | 2013-03-05 | 2017-02-28 | White Ops, Inc. | Method and system for web integrity validator |
US20140283038A1 (en) | 2013-03-15 | 2014-09-18 | Shape Security Inc. | Safe Intelligent Content Modification |
US9225737B2 (en) | 2013-03-15 | 2015-12-29 | Shape Security, Inc. | Detecting the introduction of alien content |
US9338143B2 (en) | 2013-03-15 | 2016-05-10 | Shape Security, Inc. | Stateless web content anti-automation |
US20140281535A1 (en) | 2013-03-15 | 2014-09-18 | Munibonsoftware.com, LLC | Apparatus and Method for Preventing Information from Being Extracted from a Webpage |
US9178908B2 (en) | 2013-03-15 | 2015-11-03 | Shape Security, Inc. | Protecting against the introduction of alien content |
US9729514B2 (en) | 2013-03-22 | 2017-08-08 | Robert K Lemaster | Method and system of a secure access gateway |
WO2014168936A1 (en) | 2013-04-10 | 2014-10-16 | Ho Lap-Wah Lawrence | Method and apparatus for processing composite web transactions |
US10320628B2 (en) | 2013-06-19 | 2019-06-11 | Citrix Systems, Inc. | Confidence scoring of device reputation based on characteristic network behavior |
US9979726B2 (en) | 2013-07-04 | 2018-05-22 | Jscrambler S.A. | System and method for web application security |
US9961129B2 (en) | 2013-09-04 | 2018-05-01 | Cisco Technology, Inc. | Business transaction correlation with client request monitoring data |
US9270647B2 (en) | 2013-12-06 | 2016-02-23 | Shape Security, Inc. | Client/server security by an intermediary rendering modified in-memory objects |
US9104878B1 (en) | 2013-12-11 | 2015-08-11 | Appercut Security Ltd. | Automated source code scanner for backdoors and other pre-defined patterns |
US8954583B1 (en) | 2014-01-20 | 2015-02-10 | Shape Security, Inc. | Intercepting and supervising calls to transformed operations and objects |
US9225729B1 (en) | 2014-01-21 | 2015-12-29 | Shape Security, Inc. | Blind hash compression |
US9977904B2 (en) | 2014-02-25 | 2018-05-22 | Board Of Regents, The University Of Texas System | Systems and methods for automated detection of application vulnerabilities |
US9241004B1 (en) | 2014-03-11 | 2016-01-19 | Trend Micro Incorporated | Alteration of web documents for protection against web-injection attacks |
US20150262181A1 (en) | 2014-03-12 | 2015-09-17 | The Toronto-Dominion Bank | Systems and methods for providing populated transaction interfaces based on user-generated triggers |
US8997226B1 (en) | 2014-04-17 | 2015-03-31 | Shape Security, Inc. | Detection of client-side malware activity |
US9563929B1 (en) | 2014-05-22 | 2017-02-07 | Amazon Technologies, Inc. | Caching of content page layers |
US9405910B2 (en) | 2014-06-02 | 2016-08-02 | Shape Security, Inc. | Automatic library detection |
US9846634B2 (en) | 2014-06-25 | 2017-12-19 | Vmware, Inc. | Visual graphical user interface verification |
US9075990B1 (en) | 2014-07-01 | 2015-07-07 | Shape Security, Inc. | Reliable selection of security countermeasures |
WO2016004227A1 (en) | 2014-07-02 | 2016-01-07 | Blackhawk Network, Inc. | Systems and methods for dynamically detecting and preventing consumer fraud |
US9686300B1 (en) | 2014-07-14 | 2017-06-20 | Akamai Technologies, Inc. | Intrusion detection on computing devices |
US9639699B1 (en) | 2014-07-18 | 2017-05-02 | Cyberfend, Inc. | Detecting non-human users on computer systems |
US9438625B1 (en) | 2014-09-09 | 2016-09-06 | Shape Security, Inc. | Mitigating scripted attacks using dynamic polymorphism |
US9716726B2 (en) | 2014-11-13 | 2017-07-25 | Cleafy S.r.l. | Method of identifying and counteracting internet attacks |
US9906544B1 (en) | 2014-12-02 | 2018-02-27 | Akamai Technologies, Inc. | Method and apparatus to detect non-human users on computer systems |
US9544318B2 (en) | 2014-12-23 | 2017-01-10 | Mcafee, Inc. | HTML security gateway |
US9813440B1 (en) | 2015-05-15 | 2017-11-07 | Shape Security, Inc. | Polymorphic treatment of annotated content |
US9986058B2 (en) | 2015-05-21 | 2018-05-29 | Shape Security, Inc. | Security systems for mitigating attacks from a headless browser executing on a client computer |
WO2017007705A1 (en) | 2015-07-06 | 2017-01-12 | Shape Security, Inc. | Asymmetrical challenges for web security |
US10230718B2 (en) | 2015-07-07 | 2019-03-12 | Shape Security, Inc. | Split serving of computer code |
US9807113B2 (en) | 2015-08-31 | 2017-10-31 | Shape Security, Inc. | Polymorphic obfuscation of executable code |
US20170118241A1 (en) | 2015-10-26 | 2017-04-27 | Shape Security, Inc. | Multi-Layer Computer Security Countermeasures |
US10375026B2 (en) | 2015-10-28 | 2019-08-06 | Shape Security, Inc. | Web transaction status tracking |
-
2013
- 2013-10-16 US US14/055,714 patent/US9338143B2/en active Active
-
2014
- 2014-03-12 WO PCT/US2014/023897 patent/WO2014150659A1/en active Application Filing
-
2016
- 2016-05-06 US US15/148,139 patent/US10205742B2/en active Active
-
2018
- 2018-12-27 US US16/233,455 patent/US20190243951A1/en not_active Abandoned
Patent Citations (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20110255689A1 (en) * | 2010-04-15 | 2011-10-20 | Lsi Corporation | Multiple-mode cryptographic module usable with memory controllers |
US20120124372A1 (en) * | 2010-10-13 | 2012-05-17 | Akamai Technologies, Inc. | Protecting Websites and Website Users By Obscuring URLs |
US20120198528A1 (en) * | 2011-02-01 | 2012-08-02 | Symbiotic Technologise Pty Ltd | Methods and systems to detect attacks on internet transactions |
Cited By (70)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20150112892A1 (en) * | 2012-10-18 | 2015-04-23 | Daniel Kaminsky | System and method for detecting classes of automated browser agents |
US9313213B2 (en) * | 2012-10-18 | 2016-04-12 | White Ops, Inc. | System and method for detecting classes of automated browser agents |
US10193909B2 (en) | 2013-03-15 | 2019-01-29 | Shape Security, Inc. | Using instrumentation code to detect bots or malware |
US10536479B2 (en) | 2013-03-15 | 2020-01-14 | Shape Security, Inc. | Code modification for automation detection |
US9794276B2 (en) | 2013-03-15 | 2017-10-17 | Shape Security, Inc. | Protecting against the introduction of alien content |
US20160119344A1 (en) * | 2013-07-04 | 2016-04-28 | Jscrambler S.A. | System and method for web application security |
US9979726B2 (en) * | 2013-07-04 | 2018-05-22 | Jscrambler S.A. | System and method for web application security |
US20150082440A1 (en) * | 2013-09-18 | 2015-03-19 | Jeremy Dale Pickett | Detection of man in the browser style malware using namespace inspection |
US10015191B2 (en) * | 2013-09-18 | 2018-07-03 | Paypal, Inc. | Detection of man in the browser style malware using namespace inspection |
US9270647B2 (en) | 2013-12-06 | 2016-02-23 | Shape Security, Inc. | Client/server security by an intermediary rendering modified in-memory objects |
US10027628B2 (en) | 2013-12-06 | 2018-07-17 | Shape Security, Inc. | Client/server security by an intermediary rendering modified in-memory objects |
US11088995B2 (en) | 2013-12-06 | 2021-08-10 | Shape Security, Inc. | Client/server security by an intermediary rendering modified in-memory objects |
US9712561B2 (en) | 2014-01-20 | 2017-07-18 | Shape Security, Inc. | Intercepting and supervising, in a runtime environment, calls to one or more objects in a web page |
US10652275B2 (en) | 2014-01-20 | 2020-05-12 | Shape Security, Inc. | Management of calls to transformed operations and objects |
US10044753B2 (en) | 2014-01-20 | 2018-08-07 | Shape Security, Inc. | Intercepting and supervising calls to transformed operations and objects |
US10187408B1 (en) | 2014-04-17 | 2019-01-22 | Shape Security, Inc. | Detecting attacks against a server computer based on characterizing user interactions with the client computing device |
US9858440B1 (en) * | 2014-05-23 | 2018-01-02 | Shape Security, Inc. | Encoding of sensitive data |
US20180121680A1 (en) * | 2014-05-23 | 2018-05-03 | Shape Security, Inc. | Obfuscating web code |
US10333924B2 (en) | 2014-07-01 | 2019-06-25 | Shape Security, Inc. | Reliable selection of security countermeasures |
US9479529B2 (en) | 2014-07-22 | 2016-10-25 | Shape Security, Inc. | Polymorphic security policy action |
US9438625B1 (en) | 2014-09-09 | 2016-09-06 | Shape Security, Inc. | Mitigating scripted attacks using dynamic polymorphism |
US9602543B2 (en) | 2014-09-09 | 2017-03-21 | Shape Security, Inc. | Client/server polymorphism using polymorphic hooks |
US20160364566A1 (en) * | 2014-09-23 | 2016-12-15 | Intel Corporation | Technologies for multi-factor security analysis and runtime control |
US10055580B2 (en) * | 2014-09-23 | 2018-08-21 | Intel Corporation | Technologies for multi-factor security analysis and runtime control |
US20160127412A1 (en) * | 2014-11-05 | 2016-05-05 | Samsung Electronics Co., Ltd. | Method and system for detecting execution of a malicious code in a web based operating system |
US10135718B2 (en) * | 2014-11-07 | 2018-11-20 | Iac Search & Media, Inc. | Service pack deployment in a method and system for providing answers to requests |
US10282550B1 (en) * | 2015-03-12 | 2019-05-07 | Whitehat Security, Inc. | Auto-remediation workflow for computer security testing |
US11042645B2 (en) | 2015-03-12 | 2021-06-22 | Ntt Security Appsec Solutions Inc. | Auto-remediation workflow for computer security testing utilizing pre-existing security controls |
US20180255154A1 (en) * | 2015-05-21 | 2018-09-06 | Shape Security, Inc. | Security Systems for Mitigating Attacks from a Headless Browser Executing on a Client Computer |
US20160344769A1 (en) * | 2015-05-21 | 2016-11-24 | Shape Security, Inc | Security systems for mitigating attacks from a headless browser executing on a client computer |
US9986058B2 (en) * | 2015-05-21 | 2018-05-29 | Shape Security, Inc. | Security systems for mitigating attacks from a headless browser executing on a client computer |
WO2016186736A1 (en) * | 2015-05-21 | 2016-11-24 | Shape Security, Inc. | Security systems for mitigating attacks from a headless browser executing on a client computer |
US10367903B2 (en) * | 2015-05-21 | 2019-07-30 | Shape Security, Inc. | Security systems for mitigating attacks from a headless browser executing on a client computer |
US10798202B2 (en) | 2015-05-21 | 2020-10-06 | Shape Security, Inc. | Security systems for mitigating attacks from a headless browser executing on a client computer |
US9967273B2 (en) * | 2015-06-15 | 2018-05-08 | Microsoft Technology Licensing, Llc. | Abusive traffic detection |
US10554679B2 (en) | 2015-06-15 | 2020-02-04 | Microsoft Technology Licensing, Llc | Abusive traffic detection |
US10567419B2 (en) | 2015-07-06 | 2020-02-18 | Shape Security, Inc. | Asymmetrical challenges for web security |
WO2017007705A1 (en) * | 2015-07-06 | 2017-01-12 | Shape Security, Inc. | Asymmetrical challenges for web security |
US10382482B2 (en) | 2015-08-31 | 2019-08-13 | Shape Security, Inc. | Polymorphic obfuscation of executable code |
US9674309B2 (en) | 2015-09-25 | 2017-06-06 | International Business Machines Corporation | Data sharing |
US10075535B2 (en) | 2015-09-25 | 2018-09-11 | International Business Machines Corporation | Business logic sharing |
US9501273B1 (en) * | 2015-09-25 | 2016-11-22 | International Business Machines Corporation | Data sharing |
US9705988B2 (en) | 2015-09-25 | 2017-07-11 | International Business Machines Corporation | Data sharing |
US10375026B2 (en) * | 2015-10-28 | 2019-08-06 | Shape Security, Inc. | Web transaction status tracking |
US20170147828A1 (en) * | 2015-11-24 | 2017-05-25 | Bank Of America Corporation | Reversible Redaction and Tokenization Computing System |
US10192068B2 (en) | 2015-11-24 | 2019-01-29 | Bank Of America Corporation | Reversible redaction and tokenization computing system |
US9767307B2 (en) * | 2015-11-24 | 2017-09-19 | Bank Of America Corporation | Reversible redaction and tokenization computing system |
US10140296B2 (en) * | 2015-11-24 | 2018-11-27 | Bank Of America Corporation | Reversible redaction and tokenization computing system |
US10515126B2 (en) | 2015-11-24 | 2019-12-24 | Bank Of America Corporation | Reversible redaction and tokenization computing system |
US20170147829A1 (en) * | 2015-11-24 | 2017-05-25 | Bank Of America Corporation | Reversible Redaction and Tokenization Computing System |
US10855696B2 (en) * | 2016-03-02 | 2020-12-01 | Shape Security, Inc. | Variable runtime transpilation |
US20170257385A1 (en) * | 2016-03-02 | 2017-09-07 | Shape Security, Inc. | Variable runtime transpilation |
US10275596B1 (en) * | 2016-12-15 | 2019-04-30 | Symantec Corporation | Activating malicious actions within electronic documents |
US10701079B1 (en) | 2016-12-15 | 2020-06-30 | Open Invention Network Llc | Collaborative data sharing and co-browsing with natural language masking |
US10873599B1 (en) * | 2017-07-11 | 2020-12-22 | Zycada Networks, Inc. | Providing application security using causal graph |
US11838316B1 (en) | 2017-07-11 | 2023-12-05 | Palo Alto Networks, Inc. | Providing application security using causal graph |
US10824719B1 (en) * | 2017-08-01 | 2020-11-03 | Rodney E. Otts | Anti-malware computer systems and method |
US11948022B2 (en) * | 2017-11-22 | 2024-04-02 | Amazon Technologies, Inc. | Using a client to manage remote machine learning jobs |
US20190327267A1 (en) * | 2018-04-24 | 2019-10-24 | International Business Machines Corporation | Phishing detection through secure testing implementation |
US10826935B2 (en) * | 2018-04-24 | 2020-11-03 | International Business Machines Corporation | Phishing detection through secure testing implementation |
US11212312B2 (en) | 2018-08-09 | 2021-12-28 | Microsoft Technology Licensing, Llc | Systems and methods for polluting phishing campaign responses |
US10601868B2 (en) * | 2018-08-09 | 2020-03-24 | Microsoft Technology Licensing, Llc | Enhanced techniques for generating and deploying dynamic false user accounts |
US10931701B2 (en) * | 2019-07-18 | 2021-02-23 | Cyberark Software Ltd. | Agentless management and control of network sessions |
US10749885B1 (en) * | 2019-07-18 | 2020-08-18 | Cyberark Software Ltd. | Agentless management and control of network sessions |
US11677783B2 (en) * | 2019-10-25 | 2023-06-13 | Target Brands, Inc. | Analysis of potentially malicious emails |
US20210126944A1 (en) * | 2019-10-25 | 2021-04-29 | Target Brands, Inc. | Analysis of potentially malicious emails |
US20210136085A1 (en) * | 2019-11-05 | 2021-05-06 | GlassBox Ltd. | System and method for detecting potential information fabrication attempts on a webpage |
US11706230B2 (en) * | 2019-11-05 | 2023-07-18 | GlassBox Ltd. | System and method for detecting potential information fabrication attempts on a webpage |
US20220191172A1 (en) * | 2020-02-05 | 2022-06-16 | Shopify Inc. | Systems and methods for web traffic control |
US11290481B2 (en) * | 2020-07-09 | 2022-03-29 | Bank Of America Corporation | Security threat detection by converting scripts using validation graphs |
Also Published As
Publication number | Publication date |
---|---|
US9338143B2 (en) | 2016-05-10 |
WO2014150659A1 (en) | 2014-09-25 |
US10205742B2 (en) | 2019-02-12 |
US20160359871A1 (en) | 2016-12-08 |
US20190243951A1 (en) | 2019-08-08 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10205742B2 (en) | Stateless web content anti-automation | |
US10193909B2 (en) | Using instrumentation code to detect bots or malware | |
US11297097B2 (en) | Code modification for detecting abnormal activity | |
US9973519B2 (en) | Protecting a server computer by detecting the identity of a browser on a client computer | |
US10375026B2 (en) | Web transaction status tracking | |
US9858440B1 (en) | Encoding of sensitive data | |
US20170012960A1 (en) | Split Serving of Computer Code | |
US9325734B1 (en) | Distributed polymorphic transformation of served content | |
US9112900B1 (en) | Distributed polymorphic transformation of served content | |
US12058170B2 (en) | Code modification for detecting abnormal activity | |
Gottipati | A proposed cybersecurity model for cryptocurrency exchanges |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
AS | Assignment |
Owner name: SHAPE SECURITY INC., CALIFORNIA Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:HANSEN, MARC R.;AGARWAL, SUMIT;VARADARAJAN, SUBRAMANIAN;AND OTHERS;SIGNING DATES FROM 20130611 TO 20130612;REEL/FRAME:031511/0482 |
|
AS | Assignment |
Owner name: SHAPE SECURITY, INC., CALIFORNIA Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE ASSIGNEE NAME PREVIOUSLY RECORDED AT REEL: 031511 FRAME: 0482. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNORS:HANSEN, MARC R.;AGARWAL, SUMIT;VARADARAJAN, SUBRAMANIAN;AND OTHERS;SIGNING DATES FROM 20130611 TO 20130612;REEL/FRAME:034775/0579 |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
AS | Assignment |
Owner name: SILICON VALLEY BANK, CALIFORNIA Free format text: SECURITY INTEREST;ASSIGNOR:SHAPE SECURITY, INC.;REEL/FRAME:046243/0254 Effective date: 20180524 |
|
AS | Assignment |
Owner name: SHAPE SECURITY, INC., CALIFORNIA Free format text: RELEASE BY SECURED PARTY;ASSIGNOR:SILICON VALLEY BANK;REEL/FRAME:048501/0115 Effective date: 20190226 |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YR, SMALL ENTITY (ORIGINAL EVENT CODE: M2551); ENTITY STATUS OF PATENT OWNER: SMALL ENTITY Year of fee payment: 4 |
|
FEPP | Fee payment procedure |
Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 8TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1552); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 8 |